Stop the post-release check installing this package into itself

[ElliotDrel]

The bug

RELEASING.md told the releaser to verify a fresh publish like this:

mkdir verify && cd verify
npm install google-tools-mcp@X.Y.Z

verify/ has no package.json, and npm install <pkg> does not fail in a directory without one. npm walks up the tree, finds this project's manifest, and installs there instead. What you get:

• "google-tools-mcp": "^X.Y.Z" added to this package's own dependencies — a dependency on itself
• the same entry written into package-lock.json
• the tarball unpacked into the repo's node_modules, not the scratch directory
• an ordinary added 1 package on stdout, with no mention of which directory npm picked

The only signal that anything happened is git status afterwards.

Why it matters more than it looks

This is the step that runs after the release is already out and green. Nobody is watching the working tree at that point, and the natural next action is to move on. A self-dependency committed on a later PR would be shipped in the next tarball.

It is not hypothetical. It happened during the 3.4.5 verification an hour ago. It was caught by git status, reverted with git checkout -- package.json package-lock.json before it reached a commit, and the published 3.4.5 tarball was checked against the registry and has no self-dependency:

$ npm view google-tools-mcp@3.4.5 dependencies --json | ...
published deps count: 21
self-dependency in published 3.4.5: NONE

Introduced in 066749b. It has been the documented procedure since.

The fix

mkdir -p ../gtm-verify && cd ../gtm-verify
npm init -y > /dev/null        # load-bearing: see the warning below
npm install google-tools-mcp@X.Y.Z
node -e "setTimeout(() => {}, 40000)" | node node_modules/google-tools-mcp/dist/index.js

Three changes, each carrying its own weight:

• npm init -y before installing. This is the actual guarantee. A manifest in the current directory stops the upward walk dead.
• Scratch directory outside the repo. Belt and braces. On its own it is not sufficient (npm would just walk up to whatever is above the repo), which is why the manifest is the primary fix and the docs say so.
• git status as the last step, so if it ever does go wrong the releaser sees it while they still remember what they ran.

The failure mode and its recovery are now written directly next to the commands in a callout, rather than left for the next person to rediscover the way I did.

Also swaps (sleep 30) for a node timer. Same behavior, but the block now works from PowerShell, which is what every other command block in RELEASING.md uses.

Verification

Ran the corrected procedure end to end against the published 3.4.5:

installed into scratch:      3.4.5
scratch package.json deps:   {"google-tools-mcp":"^3.4.5"}   <- landed in the right place
boot:                        MCP Server running using stdio in 8108ms
exit:                        0
repo package.json:           NONE - repo untouched
repo package-lock.json:      NONE - lockfile untouched

Plus the standard gates:

npm run release:check   Release 3.4.6 is consistent
npm run test:ci         97 suites, 1429 passed, 2 skipped

Release

Docs-only, so this does not need a tag. package.json moves to 3.4.6 per the one-bump-per-PR convention; it can ride along with whatever gets tagged next.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 96d70a0e-e42a-4f84-b8ba-050400800ccd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6c05f56348

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Make the verification commands valid PowerShell

On Windows PowerShell—the shell used by the release steps above—this block cannot be run as claimed: Windows PowerShell 5.1 does not support &&, /dev/null is not its null sink, and the document otherwise deliberately invokes npm.cmd to avoid PowerShell's script-resolution problems. A maintainer following the established PowerShell workflow therefore fails before installing or verifying the tarball. Either provide PowerShell-native commands (using $null and npm.cmd) or state that this block requires Bash rather than claiming cross-shell compatibility.

Useful? React with 👍 / 👎.