[steipete]

Prepare mcporter 0.17.0. At the 256-transport limit, the daemon can reclaim its least recently used quiet transport before the idle deadline; active calls, Chrome owners, unknown outcomes, and failed retirements remain protected. This behavior change warrants a minor release.

Preserve all 19 Unreleased entries and contributor credits. Add a newly detected development dependency fix for Glob's cancellation-bypass advisory (GHSA-3g3m-2fjr-6pw4), overriding rimraf's Glob to 14.0.2. The patch has been available since October 27, satisfying the 48-hour cooldown, and retains Node 24 support.

Validation: release metadata and changelog bullet-preservation checks; independent P0–P2 review; source, installed npm package, native build, and release contract gates; synthetic async/sync rimraf glob cleanup. Release publication additionally requires the merged-head rehearsal and signed/notarized native verification.

Windows CI exposed a transient process-observation failure in the Chrome relay fixture. Match the existing discovery/elicitation test boundary: isolate this relay test from Windows WMI, while retaining its real MCP child and the dedicated process-retirement integration coverage. The 37 relay and process-retirement tests pass locally; static checks and updated independent review are clean.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-05T18:42:23.773195Z	c623292	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR prepares 0.17.0, patches the development Glob dependency, and isolates Windows relay tests from process-query failures.

Example: Preparing the next mcporter release

• Before: Package metadata reports 0.16.1 and development cleanup resolves Glob 13.0.6.
• After: Package metadata reports 0.17.0 and development cleanup resolves patched Glob 14.0.2.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	Focused release preparation with no concrete correctness or security finding; existing release qualification remains in progress.
Proof confidence	🌊 off-meta tidepool	Not applicable: This collaborator-authored release PR is outside the ordinary contributor proof gate; the body records installed-package, native, and cleanup validation, while the Windows change affects only test isolation.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Users need a versioned release of the accumulated fixes, with the development cleanup dependency patched.
Reason: The maintainer-authored direction is approved, and the diff prepares the release without adding runtime features or configuration.

Merge readiness

✅ Ready for maintainer review

Keep this maintainer-authored release PR open: its changes are absent from main, and no actionable patch defect was found.

Priority: P2
Reviewed head: c62329234bdb08486b3636bc16e2259d035d5631

Before merge

None.

Findings

None.

Agent review details

How this fits together

Release metadata identifies the published CLI and library, while the development cleanup chain uses rimraf and Glob; relay integration tests exercise the daemon with real MCP children.

flowchart TD
  A[Release metadata] --> B[Package and native artifacts]
  B --> C[CLI and library users]
  D[Development cleanup] --> E[rimraf]
  E --> F[Glob 14.0.2]
  G[Relay tests] --> H[Daemon and real MCP child]

Loading

Technical review

Best possible solution:

Land the release preparation after the existing branch qualification completes, then follow the documented signed-release gates.

Do we have a high-confidence way to reproduce the issue?

This is release preparation; the vulnerable Glob resolution is directly visible on main and matches the published advisory.

Is this the best way to solve the issue?

The version bump, preserved release entries, targeted dependency override, and existing test-isolation pattern form a focused release change.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 50efe6ae7470.

Provenance checked

• Release version and changelog keeps the original intent (47cbfc9: The previous release preparation established version 0.16.1; this PR advances the version and preserves the existing Unreleased entries and credits.)
• Glob dependency resolution changes intended behavior with a stated reason (938c09c: The earlier dependency refresh selected the old resolution; the new override explicitly addresses its cancellation-bypass advisory while retaining the established security overrides.)
• Windows relay-test process observation changes intended behavior with a stated reason (57dff27: Earlier work stabilized real relay fixtures with platform-scaled timing; this PR explains the narrower Windows observation boundary and preserves dedicated process-retirement integration coverage.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Pinned change and main comparison: The introduced diff changes release metadata, the Glob override and lockfile, and a Windows-only test mock; main retains package version 0.16.1 and Glob 13.0.6. (package.json:3, c62329234bdb)
• Owner direction and discussion: The collaborator-authored PR explains the minor release, security override, and Windows test isolation; the full body, comments, timeline, and review records contain no contrary owner decision. (c62329234bdb)
• Preserved process coverage: The Windows mock matches the existing singleton-discovery boundary; the separate process-retirement integration test still observes a real owned process tree through child exit. (tests/process-retirement.integration.test.ts:6, c62329234bdb)
• Repository policy and release gate: The complete root policy and VISION were read; no nested test policy, maintainer notes, or pr-simplify skill exists. The release checklist requires branch rehearsal before merging and separate signed native verification before publication. (docs/RELEASE.md:30, c62329234bdb)
• Exact-head qualification: The latest check read shows the arm64 native rehearsal still running and one cancelled dispatch; no completed failing check establishes a diff-caused failure. (c62329234bdb)
• Feature history: Merged release, dependency-security, and relay-test history consistently identifies Peter Steinberger as the routing owner. One older git-show traversal encountered an unavailable promisor object; current blobs and the relevant commit history remained readable. (pnpm-workspace.yaml:13, 50efe6ae7470)

Preflight source

Source unknown. Source comparison at the observed PR snapshot only. Completion is self-reported; body, policy, tests, execution, and report bytes are not verified.

Labels

Label changes:

• add P2: Normal release preparation includes a concrete development dependency security fix with limited runtime impact.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P2: Normal release preparation includes a concrete development dependency security fix with limited runtime impact.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed November 5, 2026, 1:56 PM ET / 18:56 UTC.