chore(release): 1.9.0 — publish the .dz/ dual-read

[ivndev001]

What

Release 1.9.0. Bumps all three version sites and adds the changelog entry for the four commits that have been sitting unreleased on main since v1.8.0 (2026-07-31).

Why

The config loader's dual-read (#64, merged as #65 on 2026-09-02) is on main and has never been published. npm dist-tags.latest is still 1.8.0, whose load.ts knows only CONFIG_FILENAME = '.ui-debugger-mcp.json' and throws when that file is absent — so a config written at the .dz/ home is invisible to every installed copy.

developerz-ai/developerz.ai#2964 (PR #3239) moves that repo's tool-service descriptor to render only .dz/ui-debugger/ui-debugger-mcp.json. That PR is green and held specifically on this release: its own .mcp.json runs @latest, and its issue names "Requires #64 released" as an explicit precondition. Merged was not enough.

Changes

• package.json, server.json (top-level version and the npm package entry), and VERSION in src/index.ts all go to 1.9.0. src/index.test.ts pins the constant against package.json and caught it after the first two bumps.
• CHANGELOG.md: a 1.9.0 entry covering the dual-read (Added) plus the two fixes since v1.8.0 — the unrequested full-document load now surfaced on the adapter contract, and the biome prune that made lint a no-op under a checkout path containing a tmp directory. The .maintainer.yml onboarding commit is not user-facing and is not listed.

Verification

Run on the release branch in a clean clone:

• bun run lint: exit 0
• bun run typecheck: exit 0
• bun run build: exit 0
• bun run test: 1171 pass, 0 fail
• grep -rn '1\.8\.0' over the tree returns only the CHANGELOG.md heading for the previous release

Post-merge

Publish a GitHub Release on v1.9.0, per PUBLISHING.md. release.yml fires on release: [published] and runs npm publish over OIDC trusted publishing, then mcp-publisher for the MCP Registry in the same job. No token to supply.

Then confirm npm view @developerz.ai/ui-debugger-mcp version reports 1.9.0 before merging developerz.ai#3239.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• Release

  • Updated the package and server version to 1.9.0.

• Documentation

  • Added release notes covering the preferred UI debugger configuration path, fallback behavior, initialization locations, malformed-file handling, and fixes for document loading and checkout pruning.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: d52edc54-89f1-4810-9088-edd9b7b623d3

📥 Commits

Reviewing files that changed from the base of the PR and between 06ec3a0 and fdb4db4.

📒 Files selected for processing (4)

• CHANGELOG.md
• package.json
• server.json
• src/index.ts

Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 3 reviews per hour.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (1)

• GitHub Check: bun (lint + typecheck + test)

🧰 Additional context used

📓 Path-based instructions (2)

Never expose authentication secrets to model context or logs.

📄 CodeRabbit inference engine (CLAUDE.md)

Files:

• src/index.ts

Use strict TypeScript and never use `any`.

📄 CodeRabbit inference engine (CLAUDE.md)

Files:

• src/index.ts

🔇 Additional comments (4)

package.json (1)

3-3: LGTM!

server.json (1)

5-5: LGTM!

Also applies to: 15-15

src/index.ts (1)

4-4: LGTM!

CHANGELOG.md (1)

8-30: LGTM!

---

📝 Walkthrough

Walkthrough

The release metadata now reports version 1.9.0 across package, server, and source files. The changelog documents configuration behavior, initialization destinations, full-document load handling, and biome fixes.

Changes

1.9.0 release

Layer / File(s)	Summary
Version synchronization and release notes package.json, server.json, src/index.ts, CHANGELOG.md	Version identifiers changed from 1.8.0 to 1.9.0. The changelog records the release changes and fixes.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: ⚪ Minimal · up to fdb4d

This release updates version metadata and changelog content for 1.9.0. The published package, server manifest, and exported version are aligned, with no current merge-blocking risk identified.

Suggested reviewers: sebyx07

Poem

A rabbit reads each line,
The patch grows clear beneath the moon,
Small changes hop in place,
Tests guard the garden path,
Reviews bloom before the dawn.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the 1.9.0 release and its primary change: publishing dual-read support for the .dz/ configuration path.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch release/1.9.0

---

_{Comment @coderabbitai help to get the list of available commands.}

[ivndev001]

Closing as a duplicate of #67, which was opened 29 minutes earlier and is the better change.

Both bump the same three version sites (package.json, server.json x2, VERSION in src/index.ts) and add a 1.9.0 changelog entry. #67 additionally fixes the ROOT CAUSE of the red CI rather than living with it: the proof-of-signin settle wait was handed the entire remaining login budget, so a rejected login — the one case the check exists to catch — was also the slowest to report, and session-builder.test.ts timed out at exactly 30,000 ms. That is why run 33647731476 was red on main at 06ec3a07, and why this branch's own run was red too. #67 fixes login.ts and modifies no test.

I did not see #67 before opening this. My mistake, and the cheap check I skipped was gh pr list on the target repo before starting.