fix: pin generated MCP uvx package spec (fix #186)#221
Conversation
Confidence Score: 4/5The generated MCP config path looks safe, but the shipped instruction templates can still drift on the next release.
src/semble/agents/*, README.md, docs/installation.md Reviews (1): Last reviewed commit: "fix installer mcp package pin" | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| `path` defaults to the current directory when omitted; git URLs are accepted. | ||
|
|
||
| If `semble` is not on `$PATH`, use `uvx --from "semble[mcp]" semble` in its place. | ||
| If `semble` is not on `$PATH`, use `uvx --from "semble[mcp]@0.4.2" semble` in its place. |
There was a problem hiding this comment.
When a later Semble package is released, the installer still copies these packaged agent templates verbatim, so fresh instruction installs can tell users or agents to run uvx --from "semble[mcp]@0.4.2" semble instead of the installed package version. That reintroduces the version drift this change fixes for generated MCP configs; the same static pin appears across the sibling files in src/semble/agents/.
| ``` | ||
|
|
||
| `--content` accepts `code` (default), `docs`, `config`, or `all`. `path` defaults to the current directory when omitted; git URLs are accepted. If `semble` is not on `$PATH`, use `uvx --from "semble[mcp]" semble` in its place. | ||
| `--content` accepts `code` (default), `docs`, `config`, or `all`. `path` defaults to the current directory when omitted; git URLs are accepted. If `semble` is not on `$PATH`, use `uvx --from "semble[mcp]@0.4.2" semble` in its place. |
There was a problem hiding this comment.
This public install command is tied to the current literal version, so a later release or checkout can still instruct users to install semble[mcp]@0.4.2. Users following the README would get an older MCP package than the Semble version whose docs they are reading unless the docs pin is generated or checked against semble.version.__version__.
1 participant
Problem
Generated MCP configs and agent instructions currently use
uvx --from "semble[mcp]" semble, which resolves the latest published package each time uv refreshes its cache. That can make installed agent configs drift away from the Semble version that generated them, and it leaves the setup exposed to unexpected or compromised future releases.Closes #186.
Fix
semble[mcp]@0.4.2.uvxcommands.Tests
uv run --extra dev pytest tests/test_installer.pyuv run --extra dev ruff check src/semble/installer/agents.py src/semble/installer/config.py tests/test_installer.pyuv run --extra dev mypy src/semble/installer/agents.py src/semble/installer/config.pygit diff --checkRisk
Low. This only changes generated/manual
uvx --frompackage specs; users can still upgrade Semble deliberately withuv tool upgrade sembleand then reinstall/regenerate configs.