fix(release): correct npm metadata and gate publishing on engine assets

npm rewrote four `bin` paths and `repository.url` on every publish and
reported the bin entries as "invalid and removed". The entries in fact
survived - 0.19.0 and 0.19.1 both carry all of theirs on the registry -
but the warning was indistinguishable from a real failure and cost a
publish that was aborted on the assumption it had broken something.
Store the forms npm normalizes to, so a clean publish is silent and any
future warning means something.

package-npm.sh treated a package.json/server.json version mismatch as a
warning, printed into the middle of npm pack output where it scrolls
past. The two files are published to two different registries under one
version, and republishing that version cannot correct a disagreement
between them, so this now aborts instead.

The package ships no engine: every install fetches one from the release
tagged with the engine's version. Publishing ahead of those assets makes
a package that installs cleanly and then has nothing to run, so the
assets are probed before packing rather than trusted.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017rVbt7rENTwXkdHt3Bpgb5

Author: anvanster

mcp-package/package.json

@@ -7,7 +7,7 @@
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
-    "url": "https://github.com/codegraph-ai/CodeGraph"
+    "url": "git+https://github.com/codegraph-ai/CodeGraph.git"
   },
   "keywords": [
     "mcp",
@@ -20,10 +20,10 @@
     "copilot"
   ],
   "bin": {
-    "codegraph-mcp": "./bin/codegraph-mcp.js",
-    "codegraph-daemon": "./bin/codegraph-daemon.js",
-    "codegraph-mcp-install-hooks": "./bin/install-hooks.js",
-    "codegraph-mcp-fetch-engine": "./bin/fetch-engine-cli.js"
+    "codegraph-mcp": "bin/codegraph-mcp.js",
+    "codegraph-daemon": "bin/codegraph-daemon.js",
+    "codegraph-mcp-install-hooks": "bin/install-hooks.js",
+    "codegraph-mcp-fetch-engine": "bin/fetch-engine-cli.js"
   },
   "files": [
     "bin/",

scripts/package-npm.sh

@@ -5,7 +5,6 @@
 # Package the npm MCP server distribution.
 # Run from the repo root after all platform binaries are built.
 #
-# Usage:
 # The engine is not bundled: it is fetched from the GitHub release at install
 # time by bin/postinstall.js. Publish the release assets first with
 # ./scripts/publish-release-assets.sh, or installs of this version will fail to
@@ -60,9 +59,27 @@ echo ""
 echo "package.json version: $PKG_VERSION"
 echo "server.json version:  $SERVER_VERSION"
 
+# A mismatch here is fatal rather than a warning. The two files are published to
+# two different registries under one version, and a warning scrolls past in the
+# npm pack output - leaving npmjs.com and the MCP Registry disagreeing about what
+# this release is, which cannot be corrected by republishing the same version.
 if [ "$PKG_VERSION" != "$SERVER_VERSION" ]; then
-  echo "WARNING: version mismatch between package.json and server.json"
+  echo "ERROR: version mismatch between package.json ($PKG_VERSION) and server.json ($SERVER_VERSION)" >&2
+  exit 1
+fi
+
+# The npm package contains no engine; every install fetches one from the release
+# tagged with this version. Publishing before those assets exist produces a
+# package that installs cleanly and then has nothing to run.
+ENGINE_VERSION=$(node -e "console.log(require('$PKG_DIR/bin/fetch-engine').ENGINE_VERSION)")
+echo "engine version:       $ENGINE_VERSION (fetched at install time)"
+if ! curl -fsSL -o /dev/null \
+  "https://github.com/codegraph-ai/CodeGraph/releases/download/v${ENGINE_VERSION}/codegraph-server-linux-x64.sha256"; then
+  echo "ERROR: no published engine assets for v${ENGINE_VERSION}" >&2
+  echo "  Run ./scripts/publish-release-assets.sh first, or installs will find no engine." >&2
+  exit 1
 fi
+echo "  ✓ engine assets are published for v${ENGINE_VERSION}"
 
 # Step 4: Pack
 echo ""