Publish v0.1.17 to npm with trusted publishing

[denial123789]

Current blocker

The public npm package is still behind the immutable GitHub release:

npm latest                         0.1.14
GitHub release                     0.1.17
Official MCP Registry              0.1.17 (active/latest)

Verified on 2026-08-28 with:

npm view @sandbaseai/cli dist-tags version --json
curl -fsSL 'https://registry.modelcontextprotocol.io/v0.1/servers/io.github.sandbaseai%2Fcli/versions/0.1.17'

The earlier Release to npm run completed checkout, package identity checks, dependency installation, lint, tests, build, and package audit. Its final npm publish failed with an npm permission/not-found response:

npm error E404 Not Found - PUT https://registry.npmjs.org/@sandbaseai%2fcli
The requested resource @sandbaseai/cli@0.1.17 could not be found or you do not have permission to access it.

Failed run: https://github.com/sandbaseai/cli/actions/runs/32213056689

This is an npm package-authorization/configuration gap, not a build or MCP Registry failure.

Required npm configuration

In the npm settings for @sandbaseai/cli, configure a GitHub Actions trusted publisher with these exact values:

• GitHub owner / organization: sandbaseai
• Repository: cli
• Workflow file: release.yml
• Environment: npm-production

The existing workflow already grants id-token: write, uses npm 11.15+, and intentionally does not store or pass a long-lived npm token.

Acceptance criteria

1. Configure the exact npm Trusted Publisher identity above.

2. Re-run the existing publish workflow for the immutable v0.1.17 tag; do not create or move the tag.

3. Verify:

   npm view @sandbaseai/cli@0.1.17 version
   npm view @sandbaseai/cli dist-tags --json

4. Confirm the package page shows provenance for v0.1.17.

5. Verify the normal installation path works:

   npx -y @sandbaseai/cli@0.1.17 catalog --json

The official MCP Registry publication is already complete and does not need to be rerun solely to fix npm.

Why this matters

Publishing v0.1.17 restores the short, discoverable npx @sandbaseai/cli path and removes the need for most users to install from the longer GitHub Release archive URL.

[liyangbing]

Repository-side evidence: .github/workflows/release.yml already requests id-token: write, installs npm 11.15+, and publishes without NODE_AUTH_TOKEN; .github/workflows/publish-mcp-registry.yml already uses GitHub OIDC for the MCP Registry.

Public registry state still reports @sandbaseai/cli latest as 0.1.14, while the immutable GitHub release is v0.1.17. That means the remaining trusted-publishing step is npm/org configuration for the package and the npm-production environment, not another README workaround. A maintainer with npm package admin access should verify the package's trusted publisher entry matches repository sandbaseai/cli, workflow release.yml, and the release environment before rerunning a tag release. No token should be added to the repository.

[denial123789]

Status correction (verified 2026-08-28): the official MCP Registry is no longer blocked. It now returns io.github.sandbaseai/cli@0.1.17 as active and latest, with the remote Streamable HTTP endpoint https://sandbase.ai/v1/mcp:

https://registry.modelcontextprotocol.io/v0.1/servers/io.github.sandbaseai%2Fcli/versions/0.1.17

The remaining release gap is npm only:

npm view @sandbaseai/cli version  -> 0.1.14
GitHub release                    -> 0.1.17
MCP Registry                      -> 0.1.17 (active/latest)

So the acceptance criteria can be narrowed to configuring npm Trusted Publishing for the exact sandbaseai/cli + release.yml + npm-production identity, rerunning the existing publish job, and verifying npm view @sandbaseai/cli@0.1.17 version. The Registry publication step is already complete and should not be rerun merely to fix npm.

[liyangbing]

Re-verified the current blocker by rerunning the immutable v0.1.17 release workflow on 2026-08-28:

• Run (attempt 2): https://github.com/sandbaseai/cli/actions/runs/32213056689
• Repository-side identity check, frozen install, lint, tests, build, and package audit all passed.
• npm generated a signed provenance statement and published it to the transparency log: https://search.sigstore.dev/?logIndex=2621962252
• The final registry write still failed with:

npm error E404 Not Found - PUT https://registry.npmjs.org/@sandbaseai%2fcli
The requested resource '@sandbaseai/cli@0.1.17' could not be found or you do not have permission to access it.

Public state remains @sandbaseai/cli@0.1.14 on latest. This confirms the package artifact and GitHub OIDC/provenance path are healthy, while the npm package/org Trusted Publisher authorization is still missing or does not exactly match sandbaseai/cli + release.yml + npm-production.

No tag, package version, workflow, token, or registry metadata was changed during this verification. Do not rerun again until the npm-side publisher identity has been confirmed.