release

Releasing pi-cli-mcp

Publishing happens in CI, triggered by a tag. npm publish from a workstation works but produces a package without provenance — 0.4.0 went out that way and has dist.attestations: null, while 0.5.0 went through the tag and carries a SLSA attestation. Use the tag.

The sequence

Move the Unreleased entries in CHANGELOG.md under the new version with its date first — after the tag is pushed the publish has already happened and the entry is being written from memory.

npm version <new-version> --no-git-tag-version   # updates package.json AND package-lock.json
npm run check                                    # format, types, full suite
git add package.json package-lock.json CHANGELOG.md
git commit
git tag -a vX.Y.Z -m "<what changed in behaviour>"
git push origin main
git push origin vX.Y.Z                           # this is what publishes

Then confirm, on the registry rather than on trust:

gh run watch $(gh run list --limit 1 --json databaseId --jq '.[0].databaseId') --exit-status
npm view pi-cli-mcp version
npm view pi-cli-mcp --json | python3 -c "import json,sys; print(json.load(sys.stdin)['dist'].get('attestations'))"

attestations: null means the tag path was bypassed.

Choosing the number

Pre-1.0, so nothing is strictly forced, but keep the signal honest: a changed default is a behaviour change even when the API is identical. Making rpc the default transport went out as 0.5.0, not 0.4.1, so that anyone reading the number sees it.

What has actually gone wrong here

• npm version vs hand-editing. Bumping the version by editing package.json directly leaves package-lock.json behind. That lock sat on 0.3.0 — with a bin path that stopped existing at the TypeScript migration — and shipped inside tag v0.5.0 that way. npm ci accepts such a lock without complaint, so CI will not tell you. The pre-commit hook now will; see the validation skill.
• A second copy of the version. SERVER_INFO used to hard-code it, and the copy clients see in the MCP handshake was a release behind. It is read from package.json now — do not reintroduce a literal.
• Push main too. Only the tag is needed to publish, but if main lags, the README people read describes different behaviour from the package they installed.