Candidate MCP/CLI artifact emitted into generated terminal MCP client
configurations.
This must name a version that is actually published to the public registry:
the generated .mcp.json / claude_desktop_config.json run
npx -y --package <pin> honua-mcp-proxy, so a pin that only exists in this
repository's release lineage produces an uninstallable configuration on a
clean machine. Repository release tags and mcp/CHANGELOG.md entries are
not evidence of publication - a tagged version whose npm publish failed
still appears there.
The pin previously read 0.1.7-beta.0, which the registry has never served.
@honua/sdk-js@0.1.7-beta.0 was published from a recovery branch rather than
from the sealed tag commit, so the coordinated 0.1.7 cut of @honua/mcp-server
(and create-honua-app) never happened at all. The pin is therefore held at
the highest version the registry actually serves rather than bumped to match
this repository's version; advancing it requires a real coordinated publish,
not an edit here.
test/local-install.test.ts proves the pin belongs to the repository's own
release lineage and never runs ahead of mcp/package.json; the registry
itself is only queried by the opt-in
HONUA_MCP_PIN_LIVE_ENABLED=true npm run verify:mcp-pin:live lane, never in
PR CI.
Candidate MCP/CLI artifact emitted into generated terminal MCP client configurations.
This must name a version that is actually published to the public registry: the generated
.mcp.json/claude_desktop_config.jsonrunnpx -y --package <pin> honua-mcp-proxy, so a pin that only exists in this repository's release lineage produces an uninstallable configuration on a clean machine. Repository release tags andmcp/CHANGELOG.mdentries are not evidence of publication - a tagged version whose npm publish failed still appears there.The pin previously read
0.1.7-beta.0, which the registry has never served.@honua/sdk-js@0.1.7-beta.0was published from a recovery branch rather than from the sealed tag commit, so the coordinated 0.1.7 cut of@honua/mcp-server(andcreate-honua-app) never happened at all. The pin is therefore held at the highest version the registry actually serves rather than bumped to match this repository's version; advancing it requires a real coordinated publish, not an edit here.test/local-install.test.tsproves the pin belongs to the repository's own release lineage and never runs ahead ofmcp/package.json; the registry itself is only queried by the opt-inHONUA_MCP_PIN_LIVE_ENABLED=true npm run verify:mcp-pin:livelane, never in PR CI.