This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+8 more
Affected surfaces
Summary
AI summaryRepository provider config now accepts 'github' or 'gitlab', expanding remote support.
Full changelog
Minor Changes
-
035e14e: feat: MCP boundary hardening + CLI command polish
Folds the P2 "MCP entrypoint owns a private provider contract" finding
into a single pass with CLI gap-filling — one cohesive PR because the
new CLI commands (merge,describe,describe-format,scaffold)
ride the very in-memory client helper that the boundary refactor
makes safe to commit to.@contentrain/types—MergeResult.sync-
MergeResultgains an optionalsync?: SyncResultfield. Remote
providers (GitHub, GitLab) omit it;LocalProviderpopulates it
so selective-sync bookkeeping survives the trip through the shared
RepoProvider.mergeBranch()boundary.@contentrain/mcp— provider boundary -
LocalProvidernow implements the fullRepoProvidersurface:
listBranches,createBranch,deleteBranch,getBranchDiff,
mergeBranch,isMerged,getDefaultBranch. All seven wrap
existing simple-git / transaction helpers through a new
providers/local/branch-ops.tsmodule that mirrors the
providers/github/branch-ops.tsshape. -
mergeBranch(branch, into)assertsinto === CONTENTRAIN_BRANCH—
the local flow merges feature branches into the content-tracking
branch and advances the base branch viaupdate-ref, so arbitrary
targets would bypass that invariant. -
server.ts: the privateToolProvider = RepoReader & RepoWriter & { capabilities }alias collapses totype ToolProvider = RepoProvider. Tool handlers now depend on the shared surface
directly; the alias is kept purely so existingToolProvider
imports do not have to migrate. -
providers/local/types.ts—LocalSelectiveSyncResultis removed
in favour of the sharedSyncResultfrom@contentrain/types.
workflowOverrideis typed with the sharedWorkflowModeunion
instead of the duplicated'review' | 'auto-merge'literal.
Matching swap insidegit/transaction.tsso the whole write path
speaks one union.contentrain— four new commands + shared MCP client -
utils/mcp-client.ts— new sharedopenMcpSession(projectRoot)
helper built onInMemoryTransport.createLinkedPair(). Used by
the new commands and available for future ones that wrap MCP
tools one-shot. -
contentrain merge <branch>— scriptable single-branch sibling
tocontentrain diff. Delegates to the samemergeBranch()MCP
helper so dirty-file protections + selective-sync warnings are
preserved.--yesskips the confirmation prompt for CI use. -
contentrain describe <model>— wrapscontentrain_describe.
Human-readable metadata + fields + stats + import snippet view,
with--sample,--locale,--json. -
contentrain describe-format— wrapscontentrain_describe_format.
Useful for humans pairing with an agent that's asked for the
format primer. -
contentrain scaffold --template <id>— wraps
contentrain_scaffold. Interactive template picker when no flag
is passed;--locales en,tr,de,--no-sample,--json. -
commands/status.ts— branch-health thresholds (50/80) now come
fromcheckBranchHealth()instead of being duplicated inline. The
JSON output surfaces the fullbranch_healthobject so CI
consumers see the same warning/blocked state the text mode does.Verification
-
pnpm -r typecheckacross@contentrain/types,
@contentrain/mcp, andcontentrain— 0 errors. -
oxlintacross MCP + CLI + types src/tests — 0 warnings. -
@contentrain/typesvitest — 110/110. -
contentrainvitest — 130/130. Includes the 11 new command tests
(merge,describe,scaffold) and the updatedstatusbranch-
health test against the newcheckBranchHealth()mock. -
New
tests/providers/local/branch-ops.test.ts— 7/7. Covers
contract shape, prefix-filtered branch listing, create/delete
round-trip, diff status mapping (added/modified), post-merge
isMergedflip,mergeBranchtarget guard, and config-driven
getDefaultBranch.Tool surface
No changes. Same 16 MCP tools, same arg schemas, same response
shapes. The boundary changes are purely internal.
-
-
cb8f65e: feat(types): RepoProvider contracts + widened
repository.providerContentrainConfig.repository.provideris now'github' | 'gitlab'(was a hardcoded'github'). Reflects the two remote providers@contentrain/mcpships today.- The provider-agnostic engine contracts used by
@contentrain/mcpare now exposed directly from@contentrain/types:RepoReader,RepoWriter,RepoProviderProviderCapabilities,LOCAL_CAPABILITIESApplyPlanInput,Commit,CommitAuthorFileChange,Branch,FileDiff,MergeResult
Third-party tools can now implement a custom
RepoProviderwithout
taking a runtime dependency on@contentrain/mcp.@contentrain/mcp/core/contractskeeps re-exporting every symbol, so
existing MCP-based imports are unchanged.
Patch Changes
-
ca54941: docs: phase R2 — align every package README with current public surface
Each package README was cross-checked against its
src/exports,
package.jsonexportsmap, and (for MCP) theTOOL_ANNOTATIONS
registry. Every claim in the rewritten READMEs is verified against the
current codebase.@contentrain/types- Adds the provider-contracts section (
RepoProvider,RepoReader,
RepoWriter,ProviderCapabilities,Commit,Branch,FileDiff,
MergeResultwith optionalsync?: SyncResult,LOCAL_CAPABILITIES). - Documents
NormalizePlan*types,CONTENTRAIN_BRANCHconstant,
SECRET_PATTERNS,ModelSummary. - Keeps the browser-compatible validate/serialize surface described
for Studio integration.
@contentrain/mcp- Tool count corrected to 17 (was 13/16 depending on section).
contentrain_doctorrow added to the annotations table. - Subpath export list now lists every entry in
package.json:
/core/doctor,/core/contracts,/core/ops,/core/overlay-reader,
/tools/annotations. mergeBranchdescription notes thecr/*branch naming.- Capability gates section mentions doctor alongside scan/apply.
contentrain(CLI)- Global
--debugflag +CONTENTRAIN_DEBUGenv var documented. - New flags table:
--jsonon status/doctor/validate/generate/diff/
describe/scaffold;--watchon validate/generate;--demoand
--mcpHttp/--authTokenon serve. setup,skills,merge,describe,describe-format,scaffold
commands added to the command table.- Secure-by-default HTTP transport auth described.
@contentrain/query- Clarified that
contentrain generate(CLI) is the recommended entry
point andcontentrain-query generateis the programmatic path. - Added TypeScript snippet for the programmatic
generate()API.
@contentrain/rulesMCP_TOOLSlength corrected to 17 (includescontentrain_merge
andcontentrain_doctor).- New Parity section that explains how drift is prevented by
tests/mcp-parity.test.ts. shared/directory catalog added (11 rule files, previously
undocumented).- Context bridge section includes the 4 stack templates.
@contentrain/skills- Reference discovery pattern documented (
references/*.mdloaded on
demand, tier table for progressive disclosure). - New Parity section mirroring the rules package.
- Quick discovery snippet added to Public Exports.
No code changes — READMEs only.
- Adds the provider-contracts section (
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Contentrain/ai
Local-first MCP server for AI content governance — 13 tools for model/content CRUD, validation, normalization, and i18n across any framework.
Related context
Related tools
Beta — feedback welcome: [email protected]