Skip to content

fix: derive packed tarball name from package.json for stable alias#80

Merged
debugmcpdev merged 1 commit into
mainfrom
fix/stale-latest-tarball-alias-issue-78
May 21, 2026
Merged

fix: derive packed tarball name from package.json for stable alias#80
debugmcpdev merged 1 commit into
mainfrom
fix/stale-latest-tarball-alias-issue-78

Conversation

@debugmcpdev
Copy link
Copy Markdown
Collaborator

Summary

Fixes #78 — the mcp-debugger-latest.tgz alias became stale after its first creation and never refreshed.

The bundle script enumerated *.tgz in the package directory, sorted lexicographically, and pop()-ed the last entry as "latest". Because 'm' > 'd', mcp-debugger-latest.tgz always won that sort over debugmcp-mcp-debugger-<version>.tgz, so the script copied the alias onto itself. I hit this while verifying #72: the freshly-built version-named tarball was minutes old, but the alias was 7 weeks old and silently exercising a pre-fix build.

Fix: derive the expected filename from package.json (name + version) instead of discovering it via readdirSync. Also closes the existing inline TODO about lexicographic semver misordering (0.9.0 > 0.10.0) — there is no sort anymore.

Test plan

  • Pre-seeded mcp-debugger-latest.tgz with 13 bytes of garbage, ran pnpm --filter @debugmcp/mcp-debugger run build, confirmed the alias was overwritten with byte-identical content to the fresh versioned tarball (cmp returned 0).
  • Bundle log shows the correct source filename: Copied debugmcp-mcp-debugger-0.20.0.tgz → mcp-debugger-latest.tgz (previously the log would have shown mcp-debugger-latest.tgz → mcp-debugger-latest.tgz).
  • Cross-platform: change is pure Node (fs.readFileSync/JSON.parse/path.join/fs.existsSync/fs.copyFileSync/String.replace) with identical behavior on Windows / macOS / Linux. pnpm pack's <scope>-<name>-<version>.tgz naming is platform-independent.

🤖 Generated with Claude Code

The bundle script copied "<scope>-<name>-<version>.tgz" to a stable
"mcp-debugger-latest.tgz" alias by listing all *.tgz files in the package
directory, sorting them lexicographically, and pop()-ing the last entry.
But "mcp-debugger-latest.tgz" itself is in that list, and 'm' > 'd', so
pop() returned the alias and the script copied it onto itself — the alias
never refreshed.

Derive the exact tarball filename from package.json (name + version) so
the alias always points at the freshly-packed artifact. Also resolves the
existing inline TODO about lexicographic sort misordering semver
(0.9.0 > 0.10.0) — there is no sort anymore.

Verified by seeding the alias with garbage, rebuilding, and confirming
the alias is overwritten with byte-identical content to the fresh
versioned tarball.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@codecov
Copy link
Copy Markdown

codecov Bot commented May 20, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@debugmcpdev debugmcpdev merged commit 2fa3d14 into main May 21, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

bundle-cli.js: mcp-debugger-latest.tgz can become stale (sort picks itself over the freshly-packed tarball)

2 participants