chore(release): promote api-to-typemcp v0.2.1

[sjungwon03]

Release promotion: api-to-typemcp v0.2.1

This release candidate is an intentional two-parent merge commit from main and reviewed dev, repairing the historical release-lineage divergence while preserving both parents. It must be merged into main with the merge commit method (not squash or rebase).

Included reviewed changes

• fix(security): harden generated-project verification and dependencies #65: harden generated-project verification, lockfile-based install, patched dependency graph, and credential/proxy environment containment
• fix: fail ClawHub release job until public publication is confirmed #61: fail closed unless ClawHub confirms the version is publicly published
• chore(release): publish api-to-typemcp v0.2.1 #67: release artifact version 0.2.1

Exact candidate

• Head: e8995f21284da417e534f12028656d3cdb97b7cf
• Parents: 699638c08dba58eb99c1cc54f6c0e193af5237ed (main) and 2274a105e701a0a93a90a636b7273f7d21b9cfa8 (dev)

Verification

• release contract: 15 passed
• docs: 8 passed; workspace: 3 passed
• bundled engine: 98 passed
• generated Petstore project: npm ci --ignore-scripts, build, Vitest, npm audit --package-lock-only (0 vulnerabilities)
• git diff --check origin/main...HEAD
• release-promotion guard regression: strict release branch plus main/dev ancestry

Closes #69

[sjungwon03-ai]

Code Review — APPROVE

PR: chore(release): promote api-to-typemcp v0.2.1
Head: cacaa04d5a72e1013230fabd50f222bbd3f6f35c
Author: sjungwon03

Summary

Clean release promotion from dev to main bundling security hardening (#65), ClawHub public-confirmation gate (#61), and the v0.2.1 version bump (#67). All code-quality CI checks pass (e2e, docs-and-harness, bundled-engine). The release-promotion check failure is the expected branch guard (requires dev ref), not a code issue.

Findings

• API client base-path fix (api-client.ts.tmpl): Correctly strips a leading / and resolves against baseUrl + "/", preserving configured path prefixes. Regression test added.
• Lockfile enforcement (verify_generated.py): inspect_package now rejects projects without package-lock.json before install. npm ci --ignore-scripts replaces npm install, ensuring deterministic dependency graphs.
• Environment containment: Smoke subprocesses receive only TYPE_MCP_BASE_URL and PATH — no parent environment cloning. NODE_OPTIONS/NODE_PATH removed from the safe set. Proxy and audit disabled for npm.
• ClawHub publication gate (skill-release.yml): Captures CLI output, parses JSON, and fails closed unless status, publicationStatus, and version all match. Prevents false-positive releases.
• Dependency updates: SDK ^1.30.0, Vitest ^4.1.10, and @hono/node-server override 2.0.12 align with the security audit recommendations.
• Documentation consistency: npm install → npm ci propagated through validators, docs, and tests.
• Security regression tests: Three focused tests cover lockfile requirement, environment containment, and patched dependency ranges.

Non-blocking observations

• The PR description correctly notes this must be merged with the merge commit method to preserve the intentional two-parent lineage repair.
• Task briefs (#63, #65, #67, #69) are included for traceability.

No code-quality blockers identified.

[sjungwon03-ai]

Code Review — APPROVE

PR: chore(release): promote api-to-typemcp v0.2.1
Head: e8995f21284da417e534f12028656d3cdb97b7cf
Author: sjungwon03

Summary

Release promotion from dev to main bundling security hardening (#65), ClawHub public-confirmation gate (#61), and the v0.2.1 release artifact (#67). The diff is well-scoped: 24 files, mostly version bumps, documentation alignment, and three substantive code changes.

Correctness

• api-client.ts.tmpl base-path fix: The normalizedPath + baseUrl + "/" pattern correctly preserves a configured base-path prefix (e.g. /v2) when endpoint paths start with /. Regression test added in test_render.py.
• verify_generated.py: Lockfile gate fails fast before install; npm ci --ignore-scripts replaces npm install for reproducible lockfile-based builds; proxy env vars explicitly cleared. All correct.
• Release promotion workflow: The strict release/<positive-int>-<kebab> regex, dual ancestry checks (origin/main and origin/dev), and two-parent merge-commit assertion are sound guards. Pinned checkout SHA is good practice.

Security

• Smoke-test child processes now receive only { TYPE_MCP_BASE_URL, PATH } instead of ...process.env — eliminates credential leakage to generated MCP servers.
• _SAFE_ENV_KEYS reduced (dropped SHELL, NODE_OPTIONS, NODE_PATH), tightening the containment boundary.
• @hono/node-server pinned via overrides to 2.0.12, and SDK/Vitest ranges updated to reviewed versions.
• New test_verify_generated_security.py covers lockfile enforcement, env-clone prevention, and patched dependency ranges.

CI

All required checks pass on the exact head SHA: e2e, bundled-engine, docs-and-harness, release-promotion (success); release-skill (skipped, expected pre-merge).

Verdict

No code-quality blockers. Security posture is materially improved, tests are comprehensive, and documentation is consistently updated across SKILL.md, README, architecture overview, and security guide.

[sjungwon03-ai]

Independent exact-HEAD review at e8995f2.

Verified: two-parent merge (old main 699638c then reviewed dev 2274a10), both origin/main and origin/dev are ancestors, full-history checkout with pinned actions/checkout SHA + fetch-depth 0, release branch regex allows only dev or strict release/- with no bypass, release branches require exactly two parents, ClawHub public confirmation gate, lockfile-based npm ci containment, patched dependency ranges. All 5 CI checks green on this exact SHA. Focused local checks: 15 release-contract tests, 13 render/security tests, 38+15 doc validations all pass. No unrelated side effects. AP...OVE.