Promotion: next → main (0.8.13-beta.17, no cut yet)

.claude-plugin/marketplace.json

@@ -2,7 +2,7 @@
   "name": "doiget",
   "metadata": {
     "description": "The doiget marketplace — one plugin: an OA-first paper fetcher for DOIs and arXiv IDs.",
-    "version": "0.8.11"
+    "version": "0.8.12"
   },
   "owner": {
     "name": "QAtlasHub",

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "doiget",
   "description": "Turn DOIs and arXiv IDs into local PDFs and structured metadata via official Open-Access APIs. Never bypasses paywalls.",
-  "version": "0.8.11",
+  "version": "0.8.12",
   "author": {
     "name": "Sota Shimozono",
     "url": "https://github.com/QAtlasHub/doiget"

.github/workflows/ci.yml

@@ -89,6 +89,29 @@ jobs:
       # so test and clippy exercise an identical feature surface.
       - run: cargo test --workspace --all-targets --no-default-features --features oa-only
 
+  # The five jobs above skip `#[ignore]`d tests, which is where the one
+  # 10-minute test lives. It is a dispatch-loop property that varies with
+  # neither OS nor Cargo feature, so running it in all five spent ~50 minutes
+  # per CI run learning the same thing five times. Once is enough.
+  #
+  # NOT a sixth leg of the `test` matrix: it has to run in PARALLEL with the
+  # others rather than lengthen one of them, and it needs no OS spread.
+  test-slow:
+    name: test (slow)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2.9.2
+        with:
+          cache-bin: false
+      # `--ignored` runs ONLY the ignored tests, so this job is exactly the
+      # slow set and the five broad jobs are exactly everything else. Nothing
+      # is dropped by the split and nothing is run twice.
+      - run: cargo test --workspace --all-targets --no-default-features --features oa-only -- --ignored
+
   test-citation:
     name: test (citation feature)
     runs-on: ubuntu-latest

.github/workflows/codeql.yml

@@ -42,14 +42,14 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1   # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: ${{ matrix.language }}
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/coverage.yml

@@ -35,7 +35,7 @@ jobs:
         with:
           components: llvm-tools-preview
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2.9.2
-      - uses: taiki-e/install-action@ba47c86ac325773530516bb756137ac718732518  # v2.86.5
+      - uses: taiki-e/install-action@37f7c5781271959fb65b6b35224e28652ff2b63d  # v2.87.0
         with:
           tool: cargo-llvm-cov
       - name: Generate workspace coverage (lcov)

.github/workflows/posture-lint.yml

@@ -119,6 +119,45 @@ jobs:
           fi
           echo "LICENSE OK: verbatim SPDX MIT, no trailing prose, ends at SOFTWARE., LF."
 
+      - name: MCP_TOOLS.md lists exactly the tools the router exposes (#553)
+        shell: bash
+        run: |
+          set -euo pipefail
+          # `MCP_TOOLS.md` is what an integrator reads to decide what the server
+          # can do, and `docs/INTEGRATION/*.md` points at it. Nothing checked it
+          # against the router, and it had drifted in BOTH directions at once:
+          # four tools shipped with no entry (#553), and one had an entry while
+          # not shipping at all (#552). Neither is visible from inside the other
+          # file.
+          #
+          # rmcp derives a tool's name from its `#[tool]` method name, so the
+          # method list is the router's own truth. Compared against the table
+          # rows, which are the document's.
+          fns="$(grep -oE '^[[:space:]]+(pub )?async fn doiget_[a-z_0-9]+' \
+                 crates/doiget-mcp/src/lib.rs \
+                 | grep -oE 'doiget_[a-z_0-9]+' | sort -u)"
+          rows="$(grep -oE '^\| .doiget_[a-z_0-9]+.' docs/MCP_TOOLS.md \
+                  | grep -oE 'doiget_[a-z_0-9]+' | sort -u)"
+          if [ -z "$fns" ] || [ -z "$rows" ]; then
+            echo "::error::posture-lint mcp-tools: read no tools from the router or no rows from MCP_TOOLS.md — one of the two patterns has stopped matching (#553)"
+            exit 1
+          fi
+          missing="$(comm -23 <(printf '%s\n' "$fns") <(printf '%s\n' "$rows"))"
+          extra="$(comm -13 <(printf '%s\n' "$fns") <(printf '%s\n' "$rows"))"
+          fail=0
+          if [ -n "$missing" ]; then
+            echo "::error::posture-lint mcp-tools: these tools ship but have no row in docs/MCP_TOOLS.md (#553)"
+            printf '  %s\n' $missing
+            fail=1
+          fi
+          if [ -n "$extra" ]; then
+            echo "::error::posture-lint mcp-tools: docs/MCP_TOOLS.md documents these, but the router has no such tool (#552)"
+            printf '  %s\n' $extra
+            fail=1
+          fi
+          [ "$fail" -eq 0 ]
+          echo "MCP_TOOLS.md and the router agree on $(printf '%s\n' "$fns" | wc -l | tr -d ' ') tools"
+
       - name: doiget-cli forwards every doiget-mcp feature (#373 / #516)
         shell: bash
         run: |
@@ -244,6 +283,82 @@ jobs:
         shell: bash
         run: bash npm/doiget-cli/test/release-checksums.test.sh
 
+      - name: Homebrew formula is generator output (#501)
+        shell: bash
+        # `Formula/doiget.rb` is generated from a release's published `.sha256`
+        # assets. #247 was closed as completed while four fifths of it had not
+        # shipped, so the formula is asserted rather than trusted.
+        #
+        # What this fails on: a hand-edit, a MALFORMED checksum, a `v`-prefixed
+        # version. What it CANNOT fail on, because it re-reads the version and
+        # the checksums from the very file under test: a well-formed checksum
+        # carrying the wrong value, or a version that is simply stale. It said
+        # it caught "a bad checksum" and it does not -- nothing here reaches the
+        # published `.sha256` assets, offline being the point. The stale-version
+        # half is covered by the release-sync check below; a wrong-value
+        # checksum is caught by `brew install` and by nothing before it.
+        run: bash scripts/update-homebrew-formula.test.sh
+
+      - name: release-tracking files name one version (#501, #511)
+        shell: bash
+        # Four files record "the last published stable", and a stable release
+        # bumps all four in one maintainer step. Nothing used to hold them
+        # together, which is how `.claude-plugin/*` sat at 0.8.11 while 0.8.12
+        # was the shipped release.
+        #
+        # What this CANNOT catch, stated so the check does not repeat the
+        # overclaim it exists to fix: forgetting the step ENTIRELY leaves all
+        # four at the previous release, mutually consistent, and green.
+        # Nothing in the repository knows which version is currently published.
+        # What it does catch is bumping some and not others, and pinning a
+        # version that was never released -- CHANGELOG.md is the only
+        # independent source of truth available offline.
+        run: |
+          set -euo pipefail
+          # `|| true` on each is load-bearing. Under `set -euo pipefail` a bare
+          # assignment takes the exit status of its command substitution, so a
+          # `grep` that matches nothing -- somebody deletes the `@version` pin from
+          # .mcp.json, or reformats a manifest -- kills the step HERE, before the
+          # `::error::` written to explain it. It failed closed, which is right, and
+          # said nothing, which is the defect this whole job exists to catch. Found
+          # by review of this change; the same shape was fixed one file over in
+          # npm/doiget-cli/test/stage-npm.test.sh.
+          formula=$(grep -oE '^  version "[^"]+"' Formula/doiget.rb | grep -oE '[0-9][^"]*' || true)
+          plugin=$(grep -oE '"version": *"[^"]+"' .claude-plugin/plugin.json | grep -oE '[0-9][^"]*' || true)
+          market=$(grep -oE '"version": *"[^"]+"' .claude-plugin/marketplace.json | grep -oE '[0-9][^"]*' || true)
+          pinned=$(grep -oE '"doiget-cli@[^"]+"' .mcp.json | grep -oE '[0-9][^"]*' || true)
+          for pair in "Formula/doiget.rb:$formula" ".claude-plugin/plugin.json:$plugin" ".claude-plugin/marketplace.json:$market" ".mcp.json:$pinned"; do
+            if [ -z "${pair#*:}" ]; then
+              echo "::error::posture-lint release-sync: no version found in ${pair%%:*} -- the file was reformatted, or .mcp.json lost its doiget-cli@<version> pin"
+              exit 1
+            fi
+          done
+          echo "formula=$formula plugin=$plugin marketplace=$market .mcp.json=$pinned"
+          for v in "$plugin" "$market" "$pinned"; do
+            if [ "$v" != "$formula" ]; then
+              echo "::error::posture-lint release-sync: release-tracking files disagree. Bump Formula/doiget.rb, .claude-plugin/plugin.json, .claude-plugin/marketplace.json and .mcp.json together (CONTRIBUTING.md, 'one step after a stable release')"
+              exit 1
+            fi
+          done
+          # An unpublished pin would send every plugin user to a 404. Any `-`
+          # suffix is a prerelease per SemVer; the first version of this listed
+          # spellings (`*-beta.*|*-rc.*`) and let `0.9.0-alpha.2` straight
+          # through, which is the enumerate-the-known-cases mistake this
+          # release is otherwise about.
+          case "$pinned" in
+            *-*)
+              echo "::error::posture-lint release-sync: .mcp.json pins a prerelease ($pinned); the plugin must point at a published stable"
+              exit 1
+              ;;
+          esac
+          # The one independent check available without a network: a version
+          # these files claim to track must have a released CHANGELOG section.
+          if ! grep -qE "^## \[$formula\]" CHANGELOG.md; then
+            echo "::error::posture-lint release-sync: the tracking files name $formula, which has no '## [$formula]' section in CHANGELOG.md -- they point at a version that was never released"
+            exit 1
+          fi
+          echo "release-tracking files agree on $formula, and CHANGELOG.md has its section"
+
       - name: npm packaging tests (#511)
         shell: bash
         # The name-list greps above cannot catch a wrong binary name, a
@@ -266,6 +381,57 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1   # v7.0.1
 
+      - name: Every hand-built error object carries a disposition (#506)
+        shell: bash
+        run: |
+          set -euo pipefail
+          # `error_object` builds most failure envelopes, but five are assembled
+          # field-by-field with `insert("code", ...)` because they also attach a
+          # `denial_context`. The first pass at #506 converted the former and
+          # missed the latter -- including the two most common failures an agent
+          # sees -- so `disposition` shipped present on some failures and absent
+          # on others, which is worse than absent everywhere.
+          #
+          # One `insert("disposition"` per `insert("code"`. Not a proof, but it
+          # fails on exactly the mistake that was made.
+          f=crates/doiget-mcp/src/lib.rs
+          # `|| true`: `grep -c` exits 1 on a zero count, and under
+          # `set -euo pipefail` that kills the step at the assignment, before
+          # the `::error::` written below to explain it. Same guard as the
+          # release-sync step and `capture()`.
+          codes="$(grep -c 'insert("code"' "$f" || true)"
+          disps="$(grep -c 'insert("disposition"' "$f" || true)"
+          if [ "$codes" != "$disps" ]; then
+            echo "::error::posture-lint: $codes hand-built error objects but $disps dispositions in $f - a failure envelope is missing error.disposition (#506)"
+            grep -n 'insert("code"' "$f"
+            exit 1
+          fi
+
+      - name: Host adjudication uses `permits`, never `matches` (#533)
+        shell: bash
+        run: |
+          set -euo pipefail
+          # `SourceAllowlist::matches` answers "is this host on the list".
+          # `SourceAllowlist::permits` answers "may we go here", which is what
+          # every gate is actually asking -- and it is the one that treats a
+          # DOI resolver as addressing rather than as a content host.
+          #
+          # #533 was a gate that asked the first question and acted on the
+          # answer: a gold-OA cc-by paper was refused at `doi.org`, one hop
+          # before the publisher whose host was already allowlisted. There
+          # were FIVE such gates and only one of them was ever walked end to
+          # end, which is #462's point exactly ("every 'unreachable source'
+          # bug passed its unit tests").
+          #
+          # The discriminator: adjudication passes a host VARIABLE
+          # (`.matches(&host)`); list-membership assertions in tests pass a
+          # LITERAL (`.matches("doaj.org")`). So a `.matches(&` anywhere is a
+          # gate that should be a `permits`.
+          if grep -rn --include='*.rs' '\.matches(&' crates/ ; then
+            echo "::error::posture-lint: host adjudication must call permits(), not matches() - see http::is_transparent_resolver (#533)"
+            exit 1
+          fi
+
       - name: No outbound-network APIs in unit / integration tests
         shell: bash
         run: |

.github/workflows/release-plz.yml

@@ -793,7 +793,45 @@ jobs:
           # `EALLOWGIT: Refusing to fetch "github:npm-stage/doiget-darwin-arm64"`
           # and the job died before reaching the registry at all. A path spec
           # has to look like a path.
-          for p in ./npm-stage/doiget-*; do
-            npm publish "$p" --provenance --access public --tag "$DIST_TAG"
+          # The platform list comes from `stage-npm.sh`'s MAP, not from a
+          # `doiget-*` glob. The glob used to be safe because the wrapper was
+          # named `doiget`; renaming it to `doiget-cli` made the glob match it
+          # too, so v0.8.12 published the wrapper inside the loop AND again on
+          # the line below -- `npm error You cannot publish over the previously
+          # published versions: 0.8.12`, after everything had in fact shipped.
+          # It also sorted first, so the wrapper went out ahead of the packages
+          # it pins: exactly the window the paragraph above warns about.
+          #
+          # Reading the MAP cannot drift the same way. It lists platform
+          # packages only, so the wrapper is excluded by construction rather
+          # than by a name test somebody has to remember to update.
+          #
+          # The empty case is guarded, and that is not defensive noise. The
+          # pipeline ends in `sort -u`, which exits 0 on empty input, so
+          # `set -euo pipefail` gives NOTHING here: a grep that matches
+          # nothing (a reformat of the MAP block, a delimiter change) yields
+          # an empty word list, the loop runs zero times, and the step falls
+          # through to publish the wrapper alone -- green, with every platform
+          # binary silently missing. `npm install doiget-cli` would then
+          # succeed while its optionalDependencies fail to resolve.
+          #
+          # The `doiget-*` glob this replaced failed LOUDLY on no-match (the
+          # unexpanded pattern reached `npm publish` as a path that does not
+          # exist). Trading that for silence in the step that performs the
+          # irreversible publish is the wrong direction. posture-lint's
+          # `capture()` already guards the identical grep for the identical
+          # reason; it was applied to the check and not to the publish.
+          pkgs="$(grep -oE '^doiget-[a-z0-9-]+:' scripts/stage-npm.sh | tr -d ':' | sort -u || true)"
+          if [ -z "$pkgs" ]; then
+            echo "::error::release: no platform packages found in scripts/stage-npm.sh -- refusing to publish the wrapper alone"
+            exit 1
+          fi
+          count=$(echo "$pkgs" | wc -l | tr -d " ")
+          if [ "$count" -ne 4 ]; then
+            echo "::error::release: expected 4 platform packages, found $count: $(echo $pkgs)"
+            exit 1
+          fi
+          for pkg in $pkgs; do
+            npm publish "./npm-stage/$pkg" --provenance --access public --tag "$DIST_TAG"
           done
           npm publish ./npm-stage/doiget-cli --provenance --access public --tag "$DIST_TAG"

.github/workflows/typos.yml

@@ -20,4 +20,4 @@ jobs:
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1   # v7.0.1
-      - uses: crate-ci/typos@8a48f81b6c64dcfea44b3633223084c4be58ac5f     # v1.49.0
+      - uses: crate-ci/typos@4d9c206a77c041268485162b8e2579ad7a5cb9a3     # v1.50.0

.mcp.json

@@ -1,8 +1,10 @@
 {
   "mcpServers": {
     "doiget": {
-      "command": "doiget",
+      "command": "npx",
       "args": [
+        "-y",
+        "doiget-cli@0.8.12",
         "serve"
       ]
     }