chore: synchronize next with the current stable baseline

[mohanagy]

Synchronizes the prerelease integration branch next with the current stable baseline main.

Why

The roadmap is moving to a two-channel model: main is stable-only (latest), and the existing next branch becomes the prerelease integration branch (next dist-tag). Before roadmap PRs are retargeted onto next, it must contain the current stable baseline.

Contents

This PR contains only commits already present on main — no new work:

• 3371ada8 test: fix flaky stdio auto-refresh polling timeout (test: fix flaky stdio auto-refresh polling timeout (partial evidence for #654) #682)
• 06b373a4 chore(release): prepare 0.32.1 (chore(release): prepare 0.32.1 #647)
• e7c67566 fix: recover watcher rebuilds and optional doctor clients (fix: recover watcher rebuilds and optional doctor clients #646)
• 8f2e7a1e chore(deps): bump actions/setup-node from 6 to 7 (chore(deps): bump actions/setup-node from 6 to 7 #575)
• 52985a44 chore(deps-dev): bump vite from 8.1.4 to 8.2.1 (chore(deps-dev): bump vite from 8.1.4 to 8.2.1 #643)
• 534172af chore(deps-dev): bump @types/node from 26.1.1 to 26.2.0 (chore(deps-dev): bump @types/node from 26.1.1 to 26.2.0 #639)

Verified before opening: git merge-base --is-ancestor origin/next origin/main succeeds, and git rev-list --left-right --count origin/next...origin/main reports 0 6 — next had zero unique commits, so nothing on next is being discarded or rewritten.

This forward-ports the already-merged #682 stable-line correction into the prerelease line.

Merge method

Merge commit — do not squash. main and next are both long-lived branches; squashing would create a new SHA that main never receives and cause permanent identity drift between the two channels.

Scope

No source changes authored here. No release, tag, or publication. main is not modified by this PR.

Related tracking issue: #654 remains open and continues to block roadmap PR merges.

Summary by CodeRabbit

• Bug Fixes

  • Automatic refresh now recovers from temporary rebuild failures and retries without stopping monitoring.
  • Health checks provide more accurate status for configured integrations, including clearer guidance for partially configured clients.
  • Missing optional clients no longer incorrectly affect healthy installation reports.

• Documentation

  • Updated release information and changelog for version 0.32.1.
  • Updated the registry listing to reflect the new release.

• Chores

  • Improved release and publishing workflow maintenance.

[coderabbitai]

📝 Walkthrough

Walkthrough

The release updates version 0.32.1, add automatic watcher retry recovery, refine doctor health reporting for partial configurations, update CI action revisions, and refresh SBOM dependency metadata.

Changes

Watcher retry recovery

Layer / File(s)	Summary
Automatic rebuild retry and validation src/infrastructure/watch.ts, tests/unit/watch.test.ts, tests/unit/stdio-server.test.ts	Failed rebuilds now keep the watcher running, mark coverage as failed, schedule a bounded retry, and restore healthy coverage after a successful retry. Tests cover retry state, notifications, cleanup, and timeout diagnostics.

Doctor status and health evaluation

Layer / File(s)	Summary
Agent status and health reporting src/infrastructure/doctor.ts, tests/unit/doctor.test.ts	Doctor distinguishes missing and partial agents, uses stale MCP state as an attempted signal, limits installation commands, and evaluates only configured or attempted agents. Tests cover healthy Claude-only and stale Gemini configurations.

Release and dependency metadata

Layer / File(s)	Summary
Version, workflow, and release artifacts package.json, CHANGELOG.md, README.md, docs/mcp-registry/server.json, .github/workflows/*, .gitignore	Release metadata moves to 0.32.1. CI and release workflows use updated setup-node revisions. Issue artifacts are ignored.
SBOM refresh sbom.cdx.json	The SBOM updates package versions, checksums, distribution metadata, dependency references, and the yaml component.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant WatchLoop
  participant Rebuild
  participant RetryScheduler
  participant GraphCoverage
  WatchLoop->>Rebuild: start rebuild
  Rebuild-->>WatchLoop: fail transient rebuild
  WatchLoop->>GraphCoverage: mark graph stale
  WatchLoop->>RetryScheduler: schedule retry
  RetryScheduler->>WatchLoop: trigger retry
  WatchLoop->>Rebuild: retry rebuild
  Rebuild-->>WatchLoop: complete rebuild
  WatchLoop->>GraphCoverage: mark coverage complete

Loading

Possibly related PRs

• mohanagy/madar#543: Related doctor status and partial-configuration handling.
• mohanagy/madar#560: Related watcher auto-refresh failure and retry behavior.
• mohanagy/madar#682: Related auto-refresh test and artifact-ignore changes.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the branch synchronization and scope, but it omits the required Testing and Checklist sections.	Add the required Testing and Checklist sections, including test results and completed checklist items.
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: synchronizing the prerelease branch with the stable baseline.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/sync-next-with-main

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/publish-mcp-registry.yml:
- Around line 28-29: Disable npm caching in the setup-node configuration of both
release workflows: in .github/workflows/publish-mcp-registry.yml (lines 28-29)
and .github/workflows/release.yml (lines 27-29), remove cache: npm and set
package-manager-cache to false.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 4b0d874b-4302-4eb0-85be-51fd20b9762b

📥 Commits

Reviewing files that changed from the base of the PR and between 19958ba and 3371ada.

📒 Files selected for processing (16)

• .github/workflows/ci.yml
• .github/workflows/publish-mcp-registry.yml
• .github/workflows/release.yml
• .gitignore
• CHANGELOG.md
• README.md
• docs/mcp-registry/server.json
• package-lock.json
• package.json
• sbom.cdx.json
• src/infrastructure/doctor.ts
• src/infrastructure/watch.ts
• tests/unit/doctor.test.ts
• tests/unit/mcp-registry-metadata.test.ts
• tests/unit/stdio-server.test.ts
• tests/unit/watch.test.ts

[mohanagy]

Valid finding, and it is being acted on — but not in this PR, for a specific reason.

Why not here: this PR is a pure forward-port. It contains only the six commits already present on main and authors no source changes. git rev-list --left-right --count origin/next...origin/main reported 0 6, so nothing on next is being discarded. The npm-cache configuration in publish-mcp-registry.yml is pre-existing on main and is unchanged by this PR — it appears in the diff only because next was behind. Fixing it here would mean next and main no longer carry identical content at the moment of synchronization, which is the one property this PR exists to establish.

Where it is being acted on: the finding is now an explicit requirement in the new prerelease pipeline (#687). The publish-next.yml workflow being written under that issue uses actions/setup-node without cache: npm, with an inline comment recording this reasoning — a privileged publishing job must not restore a cache that an untrusted pull-request workflow can write to.

Recommended follow-up (not in scope here): apply the same hardening to the two existing privileged workflows, publish-mcp-registry.yml and release.yml. That is a behavioral change to the stable release path and deserves its own PR and its own validation rather than riding along on a branch-synchronization commit.

Resolving this thread on the basis that the finding is pre-existing, unmodified by this PR, carried forward as a hard requirement in #687, and recommended as separate hardening work for the stable path.

[mohanagy]

Superseded and closed automatically when its base branch was recreated.

next was synchronized by deletion and recreation at main (3371ada8425efa7f8cabdac781fa227feaea7a6a) rather than by merging this PR. That was the better outcome: next had zero unique commits and was a strict ancestor of main, so recreation is lossless and leaves next at the identical SHA as main with no synthetic merge or squash commit and perfect shared ancestry between the two channels.

Merging this PR was not possible under the protect-next-prerelease ruleset, which permits only squash merges (Merge commits are not allowed on this repository). Squashing six historical main commits into one new next commit would have permanently broken shared ancestry, so it was deliberately avoided.

The branch chore/sync-next-with-main is no longer needed.