chore(release): 1.9.0 — publish the .dz/ dual-read

[ivndev001]

What

Release 1.9.0 — the version bump alone, taken from #67's first commit (45abb1a) unchanged.

Why

The config loader's dual-read (#64, merged as #65 on 2026-09-02) is on main and has never been published. npm dist-tags.latest is 1.8.0, whose src/config/load.ts knows only CONFIG_FILENAME = '.ui-debugger-mcp.json' and throws when that file is absent, so a config written at the .dz/ home is invisible to every installed copy.

developerz-ai/developerz.ai#2964 (PR #3239) is held on exactly this. Its issue names "Requires #64 released" as a precondition; merged was not enough.

Why this PR and not #67

#67 carries a second commit, e032d666, that caps a post-submit settle wait at 5 s and claims to fix the red CI on main. Two independent reviews refuted that claim by measurement and I confirmed the timings myself from the CI logs:

run	commit	settle cap	duration
33645730932	f4cb7059	no	29,581 ms (pass)
33647731476	06ec3a07	no	30,027 ms (FAIL)
33962322833	45abb1a8	no	30,002 ms (FAIL)
33963265619	e032d666	yes	29,955 ms (pass)

Capping a 30 s wait to 5 s removes 25,000 ms if that wait is the consumer. The measured delta against the same-day uncapped baseline is 47 ms, and an uncapped commit ran 374 ms faster than the capped one. A direct DEBUG=pw:api trace on main shows waitForLoadState succeeding 8 ms after the click, so the settle wait is not where the time goes. The real regression — roughly 1.9 s to 29.6 s, appearing between 2026-08-08 and 2026-09-02 — is still undiagnosed.

The cap also regresses the success path. capWait only ever shortens and no config knob can raise it, so the settle wait becomes a hard 5 s for every consumer, down from up to 30 s. A login whose navigation commits between 5 s and 30 s now falls through to "still on <url> … the login did not take. Check the credentials and the field keys" — a correct credential set reported as wrong. That is the documented default path: the README's only persona example omits expect, and the expect branch is the one that keeps the full budget.

So this PR takes 45abb1a alone. e032d666 and the undiagnosed flake are tracked separately; #67 stays open for that work.

Changes

45abb1a verbatim, no rebase, no edits:

• package.json, server.json (top-level version and the npm package entry), and VERSION in src/index.ts to 1.9.0. src/index.test.ts pins all four against package.json.
• CHANGELOG.md: the 1.9.0 entry covering the dual-read, ActResult.navigated (fix(adapter): surface a full-document load the driver did not ask for #62), and the biome prune fix (fix(lint): stop pruning the whole checkout when its path contains a tmp dir #63). It carries no claim about the login path or about CI.

Verification

Run on this branch in a clean clone:

• bun run lint, bun run typecheck, bun run build: exit 0
• bun run test: 1171 pass. One local failure, BrowserAdapter integration > (unnamed), is the suite ci.yml already quarantines as flaking under a 2-vCPU runner; it does not run in CI's gate.
• npm pack --dry-run: 1.9.0, dist/main.js (the bin) and dist/index.js (the exports) present, no src/ leakage. dist/ is gitignored but release.yml builds before publishing, so the tarball is built from this source.
• git grep '1\.8\.0' returns only the historical CHANGELOG heading.

Post-merge

Publish a GitHub Release on v1.9.0 per PUBLISHING.md. release.yml fires on release: [published], runs npm publish over OIDC trusted publishing, then mcp-publisher for the MCP Registry in the same job. Six prior releases used this path and 1.8.0 on npm carries its provenance attestation.

Note release.yml runs install, build and publish with no lint/typecheck/test step, so the publish is gated by whatever CI ran before the tag.

Then confirm npm view @developerz.ai/ui-debugger-mcp version reports 1.9.0 before merging developerz.ai#3239.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• New Features

  • Configuration resolution now prioritizes .dz/ settings, with fallback to root-level files and fail-fast precedence.
  • Initialization follows the same configuration-writing behavior.
  • Navigation results can now be detected through ActResult.navigated and optional adapter support.

• Release

  • Updated the package and server version to 1.9.0.
  • Added release documentation covering the changes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 54357e33-0c89-42f9-85e5-98f0ca83744b

📥 Commits

Reviewing files that changed from the base of the PR and between 06ec3a0 and 77081f8.

📒 Files selected for processing (4)

• CHANGELOG.md
• package.json
• server.json
• src/index.ts

Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 3 reviews per hour.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (1)

• GitHub Check: bun (lint + typecheck + test)

🧰 Additional context used

📓 Path-based instructions (2)

Never expose authentication secrets to model context or logs.

📄 CodeRabbit inference engine (CLAUDE.md)

Files:

• src/index.ts

Use strict TypeScript and never use `any`.

📄 CodeRabbit inference engine (CLAUDE.md)

Files:

• src/index.ts

🔇 Additional comments (4)

CHANGELOG.md (1)

8-33: LGTM!

Also applies to: 34-40

package.json (1)

3-3: LGTM!

server.json (1)

5-5: LGTM!

Also applies to: 15-15

src/index.ts (1)

4-4: LGTM!

---

📝 Walkthrough

Walkthrough

The PR records the 1.9.0 release, documents recent configuration and navigation changes, removes a Biome exclusion, and synchronizes version values across package, server, and exported metadata.

Changes

Release metadata

Layer / File(s)	Summary
Release notes CHANGELOG.md	The changelog adds 1.9.0 notes for configuration resolution, navigation detection, adapter behavior, and removal of the Biome /tmp exclusion.
Version declarations package.json, server.json, src/index.ts	Package, server, npm package, and exported VERSION values change from 1.8.0 to 1.9.0.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 77081

This release updates the published version metadata and release notes consistently for version 1.9.0, with no identified current-head behavior or deployment risk blocking merge.

Suggested reviewers: sebyx07

Poem

A rabbit reads each line,
The patch grows clear beneath the moon,
Small changes hop in place,
Tests guard the garden path,
Reviews bloom before the dawn.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the 1.9.0 release and its primary purpose: publishing the .dz/ dual-read configuration support.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch release/1.9.0-only

---

_{Comment @coderabbitai help to get the list of available commands.}

[ivndev001]

Blocked, and not by anything in this diff. Root cause filed as #70.

ci.yml pins bun-version: latest. Bun 1.4.x took a persona whose credentials are wrong from ~2 s to ~30 s against a 30,000 ms ceiling. Every 1.4.x run lands between 29.6 s and 30.0 s, so a pass wins by 30-420 ms and is noise rather than health. This head has now failed six times; nine CI runs total on this PR.

I am deliberately not clearing it the two easy ways. Raising STORY_TIMEOUT_MS or quarantining the story would go green over a path that still takes 30 seconds, turning a visible 15x regression into an invisible one. Re-running until a lucky green merges a suite sitting 30 ms from the edge.

The diff itself is four version strings and a changelog and was verified green: full gate locally, one green CI run on the identical tree at 45abb1a8 (run 33964715003), npm pack --dry-run confirming dist/main.js and dist/index.js reach the tarball at 1.9.0, and server.json schema-validated for the registry step.

Holding for the #70 pin. Once bun is pinned to a known-good version this should merge on a normal green.

[ivndev001]

Superseded. #67 merged at 13:46Z as b3dc019 and carries the same version bump, so this branch now conflicts with main and has nothing left to add.

For the record, the split this PR represented was not wasted: #67 shipped its second commit too, the 5 s login settle cap, whose stated cause is refuted by the 2x2 in #70. That is a follow-up on the released code now rather than a merge decision.

The release itself is proceeding from main.