0.51.0 — round four went at round three

.github/workflows/brand-sync.yml

@@ -12,6 +12,19 @@
 # branch is protected the push fails and the fallback opens a PR instead.
 # No third-party actions beyond actions/checkout — supply-chain surface stays
 # at one GitHub-owned action.
+#
+# In THIS repo main is protected (required check `test`), so the direct push
+# always fails, and GitHub Actions is not permitted to open PRs in this org
+# (PR #141: "it pushed brand-sync/20260905 and left it for a manual PR"). The
+# fallback's `|| echo …` then swallowed that too, and the run went GREEN having
+# landed nothing — a stale count sat in the README for 26 days (#123) behind a
+# green badge, which is the exact failure the header above promises cannot
+# happen. A drift this job cannot land is a FAILURE: the run is red until a
+# human opens the PR, and the branch name is fixed (`brand-sync`, force-pushed)
+# so a month of Mondays does not leave a month of orphan branches.
+# To make the fallback land on its own: enable "Allow GitHub Actions to create
+# and approve pull requests" in the org/repo Actions settings, or give the step
+# a PAT with pull-requests:write.
 name: brand-sync
 on:
   schedule:
@@ -41,11 +54,21 @@ jobs:
           git commit -m "chore: sync brand numbers from blockrun.ai/brand/numbers.json"
           if git push origin "HEAD:${GITHUB_REF_NAME}"; then
             echo "pushed to ${GITHUB_REF_NAME}"
-          else
-            BR="brand-sync/$(date +%Y%m%d)"
-            git push -f origin "HEAD:${BR}"
-            gh pr create --head "$BR" \
+            exit 0
+          fi
+          # One fixed branch, force-pushed: the rewrite is regenerated from the
+          # artifact every run, so the previous week's branch has nothing worth
+          # keeping and a dated name per run only accumulates orphans.
+          BR="brand-sync"
+          git push -f origin "HEAD:${BR}"
+          if gh pr create --head "$BR" \
               --title "chore: sync brand numbers" \
-              --body "Automated marker refresh from https://blockrun.ai/brand/numbers.json (scripts/sync-brand-numbers.mjs --refresh). Opened as a PR because the default branch is protected." \
-              || echo "PR creation unavailable — branch ${BR} pushed, needs manual PR"
+              --body "Automated marker refresh from https://blockrun.ai/brand/numbers.json (scripts/sync-brand-numbers.mjs --refresh). Opened as a PR because the default branch is protected."; then
+            echo "opened a PR from ${BR}"
+            exit 0
           fi
+          # Not a warning. The numbers drifted, this job could not land the fix,
+          # and a green run here is how a stale count sat in the README for 26
+          # days. Red until a human opens the PR from the pushed branch.
+          echo "::error::brand numbers drifted and could not be landed: push to ${GITHUB_REF_NAME} was rejected and PR creation is unavailable to GITHUB_TOKEN. Branch ${BR} is pushed — open the PR by hand (or enable 'Allow GitHub Actions to create and approve pull requests')."
+          exit 1

.github/workflows/publish.yml

@@ -37,7 +37,21 @@ jobs:
         id: v
         run: |
           PKG=$(node -p "require('./package.json').version")
-          NPM=$(npm view @blockrun/mcp version 2>/dev/null || echo "none")
+          # "none" ONLY on npm's own E404 (the package has never been published).
+          # Any other failure — a registry 5xx, a network error, a bad token —
+          # is "unknown", which the version gate step refuses. Spelling every
+          # failure as "none" made the gate pass on the one input where it must
+          # not: a package.json below latest during a registry blip, which would
+          # publish and downgrade `latest`.
+          if NPM=$(npm view @blockrun/mcp version 2>npm-view.err); then
+            :
+          elif grep -q "E404" npm-view.err; then
+            NPM=none
+          else
+            echo "::warning::npm view failed and it was not an E404:"; cat npm-view.err
+            NPM=unknown
+          fi
+          rm -f npm-view.err
           # `version=latest` is load-bearing. Without it the search endpoint pages
           # at 30 results with every isLatest=false, so the old `|| a[a.length-1]`
           # fallback returned the last row of PAGE ONE — 0.32.8, frozen since July —
@@ -55,22 +69,41 @@ jobs:
           # latest, isLatest=true.
           REG=$(curl -s "https://registry.modelcontextprotocol.io/v0/servers?search=io.github.BlockRunAI/blockrun-mcp&version=latest" \
                 | node -e "let s='';process.stdin.on('data',d=>s+=d).on('end',()=>{try{const j=JSON.parse(s);const a=j.servers||[];console.log(a[0]?.server?.version||'none')}catch{console.log('none')}})")
+          # The tag is the third target, and it needs its OWN guard computed
+          # here, not derived from the npm one. Ask the remote: actions/checkout
+          # fetches no tags, so a local lookup always says "missing".
+          if git ls-remote --exit-code --tags origin "refs/tags/v${PKG}" >/dev/null 2>&1; then
+            TAG_MISSING=false
+          else
+            TAG_MISSING=true
+          fi
           echo "pkg=$PKG"  >> "$GITHUB_OUTPUT"
           echo "npm=$NPM"  >> "$GITHUB_OUTPUT"
           echo "reg=$REG"  >> "$GITHUB_OUTPUT"
-          echo "package.json=$PKG | npm=$NPM | registry=$REG"
+          echo "tag_missing=$TAG_MISSING" >> "$GITHUB_OUTPUT"
+          echo "package.json=$PKG | npm=$NPM | registry=$REG | tag v$PKG missing=$TAG_MISSING"
+
+      # `pkg != npm` is inequality, not order. npm publish does not compare
+      # semver and points `latest` at whatever it just published, so a
+      # package.json LOWER than npm latest (a typo'd 0.5.1 for 0.51.0, or a
+      # number proposed off a stale VERSION file) would ship and downgrade
+      # every `npx -y @blockrun/mcp@latest` user. Plain Node: runs before npm ci.
+      - name: Refuse a version below npm latest
+        run: node scripts/version-gate.mjs "${{ steps.v.outputs.pkg }}" "${{ steps.v.outputs.npm }}"
 
       - name: Install dependencies
         run: npm ci
 
       - name: Build, typecheck, test
+        id: build
         run: |
           npm run build
           npm run typecheck
           npm test
 
       # ---- npm ----
       - name: Publish to npm
+        id: npm
         if: steps.v.outputs.pkg != steps.v.outputs.npm
         run: npm publish --provenance --access public
         env:
@@ -81,12 +114,31 @@ jobs:
         run: echo "npm already at ${{ steps.v.outputs.pkg }} — skipping npm publish"
 
       # ---- MCP registry ----
+      # PINNED, and checksum-verified against the same release.
+      #
+      # This used to curl `releases/latest` straight into `tar -xz` and then into
+      # /usr/local/bin — an unpinned third-party binary, executed in a job that
+      # holds the npm publish token, whose contents could change between two runs
+      # of the same commit with nothing in this repo recording it. Pinning is the
+      # part that matters: the version moves when someone here changes this line.
+      # The checksum file ships from the same release, so it proves the download
+      # is intact, not that the release is trustworthy — that is what pinning is
+      # for. Bump deliberately; the registry's own releases page lists the tag.
       - name: Install mcp-publisher
         if: steps.v.outputs.pkg != steps.v.outputs.reg
+        env:
+          MCP_PUBLISHER_VERSION: v1.8.1
         run: |
-          curl -sL "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_amd64.tar.gz" \
-            | tar -xz mcp-publisher
+          set -euo pipefail
+          os=$(uname -s | tr '[:upper:]' '[:lower:]')
+          tarball="mcp-publisher_${os}_amd64.tar.gz"
+          base="https://github.com/modelcontextprotocol/registry/releases/download/${MCP_PUBLISHER_VERSION}"
+          curl -fsSL -o "$tarball" "${base}/${tarball}"
+          curl -fsSL -o checksums.txt "${base}/registry_${MCP_PUBLISHER_VERSION#v}_checksums.txt"
+          grep " ${tarball}$" checksums.txt | sha256sum -c -
+          tar -xzf "$tarball" mcp-publisher
           sudo mv mcp-publisher /usr/local/bin/
+          rm -f "$tarball" checksums.txt
 
       - name: Stamp + publish server.json to MCP registry
         if: steps.v.outputs.pkg != steps.v.outputs.reg
@@ -108,12 +160,30 @@ jobs:
       # Same independent-guard shape as the two publishes above — it checks
       # whether the tag already exists rather than assuming, so re-runs and
       # workflow_dispatch are safe.
-      # Gated on the same version diff as the npm publish above. Without it, a
-      # push that only touched publish.yml (or a workflow_dispatch) would tag
-      # HEAD and title the release from an unrelated commit subject — precisely
-      # in the "release is missing" state this automation exists to repair.
+      #
+      # INDEPENDENT means its own guard, not npm's. This step used to be gated
+      # on `pkg != npm`, which is false the moment npm has published — so a
+      # job that went red AFTER npm (the mcp-publisher download, a registry
+      # 400, the tag push itself) could never be repaired by re-running it: the
+      # re-run found npm == pkg, skipped this step by its `if:`, and went green
+      # with no tag and no release. The in-step `gh release view` / `git
+      # ls-remote` checks that make re-runs safe never executed, because the
+      # outer condition short-circuited them. That is the drift this step was
+      # written to end, reported as success.
+      #
+      # So the gate is: the tag is ABSENT (resolved against origin, up front),
+      # and npm carries this version — either this run published it, or it was
+      # already there. A push that only touched publish.yml still cannot tag
+      # HEAD under a stale number, because then the tag already exists. A run
+      # whose build or npm publish FAILED does not tag either: `!cancelled()`
+      # lets this step run past a registry failure, and the outcome checks
+      # keep it from running past a real one.
       - name: Tag + GitHub release
-        if: steps.v.outputs.pkg != steps.v.outputs.npm
+        if: >-
+          !cancelled()
+          && steps.v.outputs.tag_missing == 'true'
+          && steps.build.outcome == 'success'
+          && (steps.npm.outcome == 'success' || steps.v.outputs.pkg == steps.v.outputs.npm)
         env:
           GH_TOKEN: ${{ github.token }}
           VERSION: ${{ steps.v.outputs.pkg }}

.gitignore

@@ -1,4 +1,4 @@
-node_modules/
+node_modules
 dist/
 *.log
 .DS_Store

AGENTS.md

@@ -1,6 +1,6 @@
 # BlockRun MCP
 
-MCP server giving Codex real-time data — markets, research, X/Twitter, crypto. Pay per call with USDC.
+MCP server giving Codex real-time data — markets, research, web search, crypto. Pay per call with USDC.
 
 ## Commands