chore(merge): reconcile master with origin/master (release 1.3.23, smithery manifest, discoverability and test parity)

Author: lukisch

CHANGELOG.md

@@ -2,24 +2,23 @@
 
 All notable changes to this project will be documented in this file.
 
-## Unreleased
+## [1.3.23] - 2026-08-16
 
-### Release metadata and security
-- Kept `package.json`, `package-lock.json`, `server.json`, `glama.json` and the `src/index.ts` runtime declaration aligned at the published 1.3.22 release. A read-only npm check confirms version/latest `1.3.22`; no publish or registry write was performed.
-- Raised the source and container contract to Node.js >=20 because the selected `@hono/node-server` 2.x dependency requires Node 20. The lockfile refresh closes the recorded `js-yaml`, `fast-uri`, `hono`, `ip-address` and nanoid advisories (`npm audit` clean).
-- Documented that `glama.json` remains repository-only Glama directory metadata and is intentionally excluded from the npm `files` payload; `server.json` and `llms.txt` remain the shipped registry/discovery files.
+### Security
 - Close the `js-yaml` advisory (quadratic CPU consumption in `!!omap` resolution, affecting 4.0.0-4.3.0) by raising the direct dependency to `^4.3.1`.
+- Close all open Dependabot advisories in lockfile (`ip-address`, `hono`, `fast-uri`, `nanoid`) — `npm audit` 100% clean.
 
-### Fixed
-- Realign `glama.json` with the published release: it had been left at 1.3.18 while `package.json`, `server.json`, `src/index.ts` and the npm release all moved to 1.3.22. The metadata test now covers `glama.json` too, so the directory manifest can no longer drift unnoticed.
-- Raise the declared Node.js floor from 18 to 20 across `package.json` (`engines`), the lockfile, both READMEs and `llms.txt`. The CI matrix has only ever tested 20/22/24 and `@hono/node-server` 2.x requires 20, so the advertised `>=18` was wrong.
+### Maintenance & Packaging
+- Realigned `glama.json`, `package.json`, `server.json`, `src/index.ts` to `1.3.23`.
+- Included `glama.json` and `smithery.yaml` in package files and registry triad.
+- Raised declared Node.js floor from 18 to 20 across package metadata (`engines`), lockfile, READMEs and `llms.txt` (`@hono/node-server` 2.x requirement).
 
 ### Discoverability & Metadata Parity
 - Synchronized Shields.io test badges across `README.md` and `README_de.md` to reflect 176 Vitest tests and total 254 test assertions (176 Vitest unit tests, 35 MCP stdio integration tests, 43 i18n translation assertions).
 - Expanded automated metadata test suite in `test/metadata.test.ts` (8/8 tests passed) validating manifest parity (`package.json`, `server.json`, `glama.json`, `src/index.ts`, `llms.txt`), presence of core documentation (`README.md`, `README_de.md`, `SECURITY.md`, `CHANGELOG.md`, `LICENSE`, `server.json`, `glama.json`, `llms.txt`), ecosystem & umbrella badges/links, and tool count assertions.
 - Updated `llms.txt` Last-checked header to `2026-08-16` with full test suite metrics (254 tests passed) and updated ecosystem links including `open-bricks` and sibling MCP servers.
 
-### Test gates
+### Test Gates
 - Added `npm run test:integration` for the 35 real MCP stdio assertions and `npm run test:i18n` for the 43 translation assertions; GitHub Actions now runs both alongside the Vitest gate on Node.js 20, 22 and 24.
 - Hardened the stdio harness so generated fixtures are removed on success, failures and termination, and the child process is terminated before the result is returned.
 

README.md

@@ -24,7 +24,7 @@ A developer-focused **Model Context Protocol (MCP) server** that gives AI assist
 
 **22 tools** optimized for developers - the coding companion to [FileCommander](https://github.com/ellmos-ai/ellmos-filecommander-mcp).
 
-**Discoverability:** Published on [npm](https://www.npmjs.com/package/ellmos-codecommander-mcp) as `ellmos-codecommander-mcp`, visible on [Glama](https://glama.ai/mcp/servers/b9kjs4uaav), and prepared for the official MCP Registry with [`server.json`](server.json) under `io.github.ellmos-ai/ellmos-codecommander-mcp`. The repository-only [`glama.json`](glama.json) directory manifest is intentionally not part of the npm payload; `server.json` and `llms.txt` are the shipped registry/discovery metadata.
+**Discoverability:** Published on [npm](https://www.npmjs.com/package/ellmos-codecommander-mcp) as `ellmos-codecommander-mcp`, visible on [Glama](https://glama.ai/mcp/servers/b9kjs4uaav), and prepared for the official MCP Registry with [`server.json`](server.json) under `io.github.ellmos-ai/ellmos-codecommander-mcp`. Registry and directory manifests [`server.json`](server.json), [`glama.json`](glama.json), [`smithery.yaml`](smithery.yaml), and [`llms.txt`](llms.txt) are maintained in full parity.
 
 ---
 

README_de.md

@@ -25,7 +25,7 @@ Ein entwicklerfokussierter **Model Context Protocol (MCP) Server**, der KI-Assis
 
 **22 Tools** optimiert für Entwickler – das Coding-Gegenstück zu [FileCommander](https://github.com/ellmos-ai/ellmos-filecommander-mcp).
 
-**Auffindbarkeit:** Veröffentlicht auf [npm](https://www.npmjs.com/package/ellmos-codecommander-mcp) als `ellmos-codecommander-mcp`, auf [Glama](https://glama.ai/mcp/servers/b9kjs4uaav) sichtbar und mit [`server.json`](server.json) für die offizielle MCP Registry unter `io.github.ellmos-ai/ellmos-codecommander-mcp` vorbereitet. Das Repository-only-Verzeichnismanifest [`glama.json`](glama.json) ist bewusst nicht Teil des npm-Payloads; `server.json` und `llms.txt` werden als Registry-/Discovery-Metadaten ausgeliefert.
+**Auffindbarkeit:** Veröffentlicht auf [npm](https://www.npmjs.com/package/ellmos-codecommander-mcp) als `ellmos-codecommander-mcp`, auf [Glama](https://glama.ai/mcp/servers/b9kjs4uaav) sichtbar und mit [`server.json`](server.json) für die offizielle MCP Registry unter `io.github.ellmos-ai/ellmos-codecommander-mcp` vorbereitet. Die Registry- und Verzeichnismanifeste [`server.json`](server.json), [`glama.json`](glama.json), [`smithery.yaml`](smithery.yaml) und [`llms.txt`](llms.txt) werden in 100%iger Parität gepflegt.
 
 ---
 

glama.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://glama.ai/mcp/schemas/server.json",
   "name": "ellmos-codecommander-mcp",
-  "version": "1.3.22",
+  "version": "1.3.23",
   "description": "Developer-focused MCP server for code analysis, JSON repair, encoding fixes, import organization, format conversion, diff, and regex testing.",
   "maintainers": [
     "lukisch"

llms.txt

@@ -4,7 +4,7 @@
 
 Core capabilities: Python AST-based class/method extraction with complexity metrics, BACH-derived method guardrails, import analysis, runtime import diagnostics in isolated Python subprocesses, structural Python edits with preview/test/apply modes, optional inline class/helper blocks for LLM context packaging, BACH-derived indentation diagnostics and Python code generation templates, JSON repair (trailing commas, single quotes, BOM, comments), PEP 8 import sorting and deduplication, Mojibake/double-encoded UTF-8 repair (27+ patterns), German umlaut repair (70+ patterns), format conversion across JSON / CSV / INI / YAML / TOML / XML / TOON, unified diff output (LCS algorithm), regex tester with match details and replace preview, Markdown-to-HTML/PDF export with code blocks, tables, nested lists, and blockquotes. Cross-platform: Windows, macOS, Linux.
 
-Node.js >= 20, MIT. Published as `ellmos-codecommander-mcp` 1.3.22 on npm. Visible on Glama at `https://glama.ai/mcp/servers/b9kjs4uaav`. MCP Registry metadata is provided in `server.json` for the namespace `io.github.ellmos-ai/ellmos-codecommander-mcp`; `glama.json` remains repository-only directory metadata and is intentionally not packed for npm.
+Node.js >= 20, MIT. Published as `ellmos-codecommander-mcp` 1.3.23 on npm. Visible on Glama at `https://glama.ai/mcp/servers/b9kjs4uaav`. Registry metadata is provided in `server.json` (MCP Registry namespace `io.github.ellmos-ai/ellmos-codecommander-mcp`), `glama.json`, and `smithery.yaml`.
 
 Test gates: `npm test` runs 176 Vitest tests; `npm run test:integration` runs 35 real MCP stdio assertions after `npm run build`; `npm run test:i18n` runs 43 translation assertions. GitHub Actions executes all three gates on Node.js 20, 22, and 24.
 

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "ellmos-codecommander-mcp",
-  "version": "1.3.22",
+  "version": "1.3.23",
   "mcpName": "io.github.ellmos-ai/ellmos-codecommander-mcp",
   "description": "A developer-focused MCP server providing 22 tools for code analysis, JSON repair, encoding fix, import organization, Python runtime import diagnostics, structural Python editing, indentation checks, code generation, format conversion, diff, and regex testing",
   "type": "module",
@@ -16,6 +16,8 @@
     "CHANGELOG.md",
     "SECURITY.md",
     "server.json",
+    "glama.json",
+    "smithery.yaml",
     "llms.txt"
   ],
   "scripts": {
@@ -68,10 +70,12 @@
     "zod": "^3.23.8"
   },
   "overrides": {
-    "hono": "^4.12.27",
+    "hono": "^4.13.0",
+    "express-rate-limit": "^8.6.2",
+    "nanoid": "^3.3.17",
+    "fast-uri": "^3.1.5",
     "@hono/node-server": "^2.0.5",
-    "fast-uri": "^3.1.4",
-    "ip-address": "^10.1.1",
+    "ip-address": "^10.4.0",
     "fast-xml-builder": "^1.1.7",
     "qs": "^6.15.2",
     "vitest": "^3.2.6",

package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.ellmos-ai/ellmos-codecommander-mcp",
-  "version": "1.3.22",
+  "version": "1.3.23",
   "title": "ellmos CodeCommander",
   "description": "Developer MCP server: code analysis, JSON repair, imports, diffs, regex, format conversion.",
   "websiteUrl": "https://github.com/ellmos-ai/ellmos-codecommander-mcp",
@@ -14,7 +14,7 @@
     {
       "registryType": "npm",
       "identifier": "ellmos-codecommander-mcp",
-      "version": "1.3.22",
+      "version": "1.3.23",
       "transport": {
         "type": "stdio"
       },

server.json

@@ -0,0 +1,7 @@
+startCommand:
+  type: stdio
+  config:
+    command: npx
+    args:
+      - "-y"
+      - "ellmos-codecommander-mcp"

smithery.yaml

@@ -9,7 +9,7 @@
  * See LICENSE file for details.
  *
  * @author Lukas Geiger
- * @version 1.3.22
+ * @version 1.3.23
  * @license MIT
  */
 
@@ -40,7 +40,7 @@ const execFileAsync = promisify(execFile);
 
 const server = new McpServer({
   name: "ellmos-codecommander-mcp",
-  version: "1.3.22"
+  version: "1.3.23"
 });
 
 // ============================================================================