LumabyteCo/clarifyprompt-mcp

What's new in 1.6.8

Housekeeping release closing the two loops the 1.6.5 → 1.6.7 cascade opened. No engine code, MCP tool surface, platform, or env-var changes.

Changed

• CI build matrix now tests Node 24 (current active LTS, EOL Apr 2028) alongside 18 / 20 / 22 across Ubuntu + macOS. The matrix previously tested two EOL versions (Node 18 EOL Apr 2025, Node 20 EOL Apr 2026) but not the current LTS at all. Verified before merge that `[email protected]` + `[email protected]` load and `vec_version()` returns cleanly on Node 24.16.0 in a toolchain-free `node:24-slim` container — which guarantees the toolchain-equipped matrix runners pass. All 8 build jobs (4 Node × 2 OS) confirmed green. `engines` stays `>=18` — maximum compatibility, and we test what we claim.
• Publish-job runner moved Node 20 → 22, keeping an EOL runtime off the release-critical `npm publish` path (matches the Dockerfile base). Internal CI hygiene, not a user-facing support change.

Process

• New ship-check `CP-13 — lockfile regeneration safety` encodes the hard lesson from the 1.6.5 → 1.6.6 → 1.6.7 cascade so it can't recur. A single `npm install --package-lock-only` after a clean `rm -rf node_modules package-lock.json`:

  1. silently dropped 4 of 5 `sqlite-vec` platform binaries (kept only the maintainer's macOS-ARM) → broke `npm ci` on Linux CI → forced 1.6.6
  2. pulled a within-caret `better-sqlite3` 12.9.0 → 12.10.0 bump that dropped Node 20 prebuilds (Node 20 EOL'd Apr 2026) → broke the `node:20-slim` Docker build → forced 1.6.7

  CP-13 mandates: full `npm install` (never `--package-lock-only`) when deps may change; a lockfile diff scanning for dropped platform/optional deps + unexpected native-dep version jumps; verification that all 5 `sqlite-vec` platforms survive; and a local slim-Docker load gate for release lockfile changes. Flagged as a strong promotion candidate to the user-scoped ship-check skill (the failure modes are general to any project with native or platform-gated deps). Dogfooded on this release — the 1.6.8 lockfile bump used full `npm install`, all 5 platforms intact, zero native-dep drift.

Why a separate release

1.6.5 cleared two CVEs but its lockfile regen broke CI twice. 1.6.8 closes the underlying drift — tests the current LTS, removes EOL Node from the publish path, and writes down the lesson — so the same class of mistake is caught at ship-check next time rather than discovered in CI. End-user installs were never affected by any of the 1.6.5–1.6.7 CI issues (the npm tarball ships neither a lockfile nor a Dockerfile).

Install

```bash
npm install -g [email protected]
```