chore: release v1.9.0 — .dz/ dual-read config resolution - #67
Conversation
## What Bumps the package to 1.9.0 across all four places that carry the version (`package.json`, `server.json` top-level + `packages[0]`, and the exported `VERSION` in `src/index.ts`), and adds the 1.9.0 CHANGELOG entry covering everything merged since v1.8.0. ## Why v1.8.0 (2026-07-31) is still `dist-tags.latest` on npm and knows only `CONFIG_FILENAME = '.ui-debugger-mcp.json'` — it throws when that file is absent. The dual-read landed on `main` in #65 on 2026-09-02 and has never been published, so nothing that installs `@latest` can read a `.dz/` config. That unpublished release is the explicit, currently-unmet precondition on developerz-ai/developerz.ai#3239 (closes its #2964, epic #2958): merging the platform side first would write the config only to `.dz/`, which 1.8.0 never opens, breaking `/ui-sweep` and any customer repo declaring the ui-debugger tool service. Cutting this release is what unblocks that merge. ## Changes - `package.json` 1.8.0 -> 1.9.0 - `server.json` — both `version` fields (top-level and `packages[0].version`), which PUBLISHING.md requires be bumped alongside package.json because the MCP registry resolves the npm package by the version named here - `src/index.ts` `VERSION` 1.8.0 -> 1.9.0 — caught by the repo's own "VERSION matches package.json" test, which failed until this line moved - `CHANGELOG.md` — 1.9.0 entry: the `.dz/` dual-read (#65), the `ActResult.navigated` full-document-load signal (#62), and the biome absolute-path prune fix (#63) Minor, not patch: the dual-read is a backwards-compatible feature — the root file still resolves, and `.dz/` only wins where it exists. ## Verification Run on the branch, after `bun install --frozen-lockfile`: - `bun run lint` — 157 files checked, clean - `bun run typecheck` — clean - `bun run build` — clean - `bun test` — 1171 pass / 10 skip / 0 fail (1181 across 75 files) - `node -e "JSON.parse(...)"` on both `server.json` and `package.json` The one failure this change had to fix was found by the gate, not by reading: `bun test` reported `(fail) VERSION matches package.json` until `src/index.ts` was bumped. No test was modified. ## Post-merge Publishing is a human step and deliberately not automated here: cut a GitHub Release `v1.9.0` (or Actions -> release -> Run workflow). `release.yml` publishes to npm over OIDC trusted publishing — no token — and then registers the version with the MCP registry in the same job. Confirm `npm view @developerz.ai/ui-debugger-mcp dist-tags` reads 1.9.0 and that the published `src/config/load.ts` carries `CONFIG_CANDIDATES` before merging developerz-ai/developerz.ai#3239. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NCugazR85MEY7B2KVpcf7F
|
Warning Review limit reached
On-demand reviews are free for the next 15 days. After that, they cost $0.25 per reviewed file. Or wait 5 minutes for your next included review. View limit detailsLimit details: You’ve used all 3 included reviews currently available. Your 41 included PR review attempts over the past 7 days set your current allowance at 3 reviews per hour. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Essentials Run ID: 📒 Files selected for processing (3)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Essentials Run ID: 📒 Files selected for processing (4)
Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 3 reviews per hour. 📜 Recent review details⏰ Context from checks skipped due to timeout. (1)
🧰 Additional context used📓 Path-based instructions (2)Never expose authentication secrets to model context or logs.📄 CodeRabbit inference engine (CLAUDE.md) Files:
Use strict TypeScript and never use `any`.📄 CodeRabbit inference engine (CLAUDE.md) Files:
🔇 Additional comments (4)
📝 WalkthroughWalkthroughThe release updates all package version declarations to 1.9.0 and adds changelog entries for configuration resolution, navigation reporting, and Biome pattern changes. ChangesRelease 1.9.0
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to This release updates published version metadata to 1.9.0 and documents the included changes. The package, server manifest, and exported version are aligned, with no outstanding merge-readiness risk. Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
…0s budget ## What `assertSignedIn`'s no-`expect` path gives its post-submit settle wait a bounded `NAVIGATION_SETTLE_MS` (5s) slice instead of the entire remaining login budget. `capWait` still shortens it further for a caller with less left, so this is a ceiling and never a floor. ## Why The settle wait's own result is DISCARDED (`.catch(() => undefined)`) — it exists only to let a redirect land before the URL that actually decides is read. And a page that never reaches network-idle is not an edge case: it is the NORMAL shape of a rejected login. The credentials POST comes back 401, the app renders an error in place, nothing navigates. So the one case this check exists to catch was also the slowest to report, at 30 seconds of silence per wrong password. ## This is why CI is red on main `session-builder.test.ts`'s "a persona whose credentials are wrong fails the run instead of opening it signed out" sets its own ceiling to `STORY_TIMEOUT_MS` (30_000) — the SAME number as `LOGIN_TIMEOUT_MS`. On a runner where the idle wait ran to term, the `AuthError` therefore arrived after the harness had already given up: the test was structurally unable to observe the behaviour it asserts, on any machine slow enough to reach the timeout. That is not a flake. Run 33647731476 on `main` (commit 06ec3a0, the commit that landed the `.dz/` dual-read) fails on exactly this test at exactly 30,002ms, and PR #67 inherited it. It passes locally because a fast box reaches network-idle in milliseconds and never touches the ceiling — the test's own timing margin was zero, and which side of it you land on is a property of the runner. No test was modified to make this pass. The prod timing was wrong; the test was right and could not run. ## Changes - `src/services/login.ts`: `NAVIGATION_SETTLE_MS = 5_000`, applied through `capWait`. The constant's docstring records the reasoning and the failing run so the next reader does not re-derive it. - `src/services/login.test.ts`: the fake adapter records `opts.timeout` on each `waitFor`, and two new tests pin the slice — one that the settle wait is 5s and not the budget, one that a 1.2s caller still shortens it to 1.2s. - `CHANGELOG.md`: under 1.9.0. ## Verification - Mutation-proven: restoring `timeout: budget` reddens the new slice test (22 pass / 1 fail); restored, 23/23. - Timing proof against a promise that never settles: the bounded wait returns in ~5.0s, inside the 30s harness ceiling; the old path spent the full 30s. - `bun run lint` clean, `bun run typecheck` clean. - `bun test`: 1173 pass / 10 skip / **0 fail** (1183 across 75 files). The wrong-credentials story now runs; the previous run on this branch was 1171/0 with that test never reaching its assertion on CI. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Scope grew by one commit, and it is the reason CI was red
I fixed it rather than releasing from a red main. It is not a flake. A page that never reaches network-idle is not an edge case, either — it is the normal shape of a rejected login. The credentials POST answers 401, the app renders an error in place, nothing navigates. So the one case the check exists to catch was also the slowest to report, at 30 seconds of silence per wrong password. The fix is a bounded Verification at
|
No content change. Commit 45abb1a is shared with #67's branch, so that SHA carries #67's own failed check-run alongside this PR's green one, and the merge-readiness gate fails closed on the pair. Re-running #67's run to green lost three coin flips in a row against the known session-builder flake, which is a pre-existing 30s timeout that reddens main itself and cannot be reached by a diff of four version strings. This empty commit gives the PR a head whose check history is its own. The full gate still runs on it; nothing is skipped, quarantined, or relaxed. The flake is tracked separately. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1 participant
What
Bumps the package to 1.9.0 across all four places that carry the version
(
package.json,server.jsontop-level +packages[0], and the exportedVERSIONinsrc/index.ts), and adds the 1.9.0 CHANGELOG entry coveringeverything merged since v1.8.0.
Why
v1.8.0 (2026-07-31) is still
dist-tags.lateston npm and knows onlyCONFIG_FILENAME = '.ui-debugger-mcp.json'— it throws when that file isabsent. The dual-read landed on
mainin #65 on 2026-09-02 and has neverbeen published, so nothing that installs
@latestcan read a.dz/config.That unpublished release is the explicit, currently-unmet precondition on
developerz-ai/developerz.ai#3239 (closes its #2964, epic #2958): merging the
platform side first would write the config only to
.dz/, which 1.8.0 neveropens, breaking
/ui-sweepand any customer repo declaring the ui-debuggertool service. Cutting this release is what unblocks that merge.
Changes
package.json1.8.0 -> 1.9.0server.json— bothversionfields (top-level andpackages[0].version),which PUBLISHING.md requires be bumped alongside package.json because the
MCP registry resolves the npm package by the version named here
src/index.tsVERSION1.8.0 -> 1.9.0 — caught by the repo's own"VERSION matches package.json" test, which failed until this line moved
CHANGELOG.md— 1.9.0 entry: the.dz/dual-read (feat(config): dual-read .dz/ui-debugger/ui-debugger-mcp.json before the root file (#64) #65), theActResult.navigatedfull-document-load signal (fix(adapter): surface a full-document load the driver did not ask for #62), and the biomeabsolute-path prune fix (fix(lint): stop pruning the whole checkout when its path contains a tmp dir #63)
Minor, not patch: the dual-read is a backwards-compatible feature — the root
file still resolves, and
.dz/only wins where it exists.Verification
Run on the branch, after
bun install --frozen-lockfile:bun run lint— 157 files checked, cleanbun run typecheck— cleanbun run build— cleanbun test— 1171 pass / 10 skip / 0 fail (1181 across 75 files)node -e "JSON.parse(...)"on bothserver.jsonandpackage.jsonThe one failure this change had to fix was found by the gate, not by reading:
bun testreported(fail) VERSION matches package.jsonuntilsrc/index.tswas bumped. No test was modified.
Post-merge
Publishing is a human step and deliberately not automated here: cut a GitHub
Release
v1.9.0(or Actions -> release -> Run workflow).release.ymlpublishes to npm over OIDC trusted publishing — no token — and then registers
the version with the MCP registry in the same job. Confirm
npm view @developerz.ai/ui-debugger-mcp dist-tagsreads 1.9.0 and that thepublished
src/config/load.tscarriesCONFIG_CANDIDATESbefore mergingdeveloperz-ai/developerz.ai#3239.
🤖 Generated with Claude Code
https://claude.ai/code/session_01NCugazR85MEY7B2KVpcf7F
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.Summary by CodeRabbit
Release
Documentation
tmp.