Follow latest Intern MCP release

[calvin-archastro]

Review on ArchCode

Problem and author intent

Setup saved the exact package version that happened to run, so every Codex and Claude registration stayed pinned after new stable releases. A one-time public-registry workaround could also disappear from the saved launcher and fall back to a stale organization-scoped registry. The intent is for installed launchers to follow npm latest reliably while preserving exact-package and tarball overrides for reviewed pins and local testing.

What changed

• The default saved package spec is now @archastro/intern-mcp@latest.
• Generated Codex and Claude launchers use --prefer-online so each host start refreshes stale latest metadata.
• Added a validated setup --registry option that accepts credential-free HTTPS registries and persists the scoped npx registry argument into the host launcher.
• Kept ordinary public setup commands clean; the duplicated npx lookup plus setup persistence flags appear only in registry troubleshooting guidance.
• Updated usage and pinning documentation.
• Extended setup tests and the packed-artifact harness to prove both real Codex and Claude writers persist latest/cache/registry policy without exposing the bearer.

Companion onboarding change: Firstlanding PR 10515.

Scope indicator

CLI/package launcher behavior only. No MCP tool or server API changes.

Risk assessment

Medium. Host restarts may execute a newly published stable release. Releases are protected by the semantic bump workflow, rebase-merged immutable commit tagging, npm OIDC, and the npm-release environment. Users can still pin a complete package spec or tarball through INTERN_MCP_PACKAGE.

User impact

Existing users can rerun setup once to replace their pinned registration. After that, Codex or Claude startup follows the latest reviewed stable package. Internal machines with an @ArchAstro registry mapping can persist the public npm exception instead of silently resolving stale GitHub Packages metadata.

Testing

• Canonical packaged E2E: scripts/harness-install-smoke.mjs, run through npm run test:harnesses (passed). It packs the current artifact, installs it in an isolated home whose @ArchAstro scope points elsewhere, crosses real setup, MCP stdio HTTP validation, and real Codex/Claude configuration writers, then asserts both launchers retained --prefer-online and the exact scoped public registry while no bearer entered configuration or diagnostics.
• npm run check passed: formatting, lint, TypeScript build, 9 test files / 34 tests, and clean-consumer package smoke.
• Direct npmjs execution proved @archastro/intern-mcp@latest resolves the public 0.1.1 CLI; unqualified scoped npx was rejected and therefore is not used.
• The validated registry parser rejects credentials, query strings, fragments, non-HTTPS URLs, duplicates, and malformed values.
• Independent adversarial reviews found and closed the registry-persistence and two-host proof gaps; final reviews reported no remaining findings.

Follow-ups and known issues

• After merge, release this change as 0.1.2 before deploying the linked Firstlanding PR.