feat: pin version on install + pin/unpin/upgrade commands - #9
Merged
Conversation
Client spawns currently run `npx -y @kunobi/mcp`, which resolves the `latest` dist-tag from the registry on every launch — a round-trip that is the slow and occasionally indefinite-hang part of startup (cf. openai/codex#14470, where a codex exec leg sat silent for ~20min on MCP startup). - install: pin to this exact version (`@kunobi/mcp@${version}`) so spawns run from the npm cache, fast and deterministic, with no `latest` lookup. - upgrade: new subcommand — checkForUpdate, then repin() every client config to the newest version, best-effort warm the npm cache, and tell the user to restart to apply. Explicit, off the spawn critical path. - The post-connect update notice now points at `kunobi-mcp upgrade` instead of a bare 'restart' hint. Upgrades stay automatic-feeling (you're informed, one command re-pins) without putting the registry on the startup path. Full suite green (90 tests).
Rounds out the pinning model so it helps existing installs, not just new ones:
- pin — re-pin every registered config to the CURRENT version (offline,
instant). For users who installed before pinning, or set up manually.
- unpin — revert to bare 'npx -y @kunobi/mcp' (always-latest). Symmetric escape
hatch; re-introduces per-spawn 'latest' resolution by choice.
- Startup hint: when an unpinned config is detected (a bare '@kunobi/mcp' arg),
suggest 'kunobi-mcp pin'. Suppressible via MCP_KUNOBI_NO_PIN_HINT=1.
pin/unpin/upgrade now share a repinAll() helper over the installer's repin().
README documents the commands, the pin/unpin tradeoff, and the new env var.
Full suite green (90 tests); typecheck + biome clean.
Pulls in repin() (published in mcp-installer v0.0.8), which pin/unpin/upgrade depend on. Resolves from the registry now — no dev link. typecheck/build/tests green against the published package.
jleni
changed the title
upgrade command
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
npx -y @kunobi/mcp@<exact-version>instead of the bare package, so client spawns run from the npm cache.kunobi-mcp upgrade: a new subcommand that checks the registry and, if newer, re-pins every client config (via the installer'srepin()), warms the npm cache, and tells you to restart to apply.kunobi-mcp upgrade.Why
npx -y @kunobi/mcpresolves thelatestdist-tag from the registry on every spawn. That round-trip is the slow / occasionally indefinite-hang part of startup — the same failure class as openai/codex#14470 (acodex execleg sitting silent for ~20 min on MCP startup). Pinning removes thelatestlookup → spawn is fast, deterministic, and can't hang on the registry. Upgrades move off the spawn critical path and become explicit (you're still informed by the existing post-connect notice; one command re-pins).Flow
installpins to the version it just fetched.checkForUpdateinforms "vX available — runkunobi-mcp upgrade".upgradere-pins all configs + warms cache → restart loads the new version (apply-on-next-start; an MCP server can't hot-swap its own running code, so we don't pretend to live-reconnect).Tests
Full suite green (90 tests); typecheck + biome clean.
upgradeglue is thin over the installer'srepin()(unit-tested in that PR); not run in CI since it performs real registry + config writes.kunobi-ninja/mcp-installer#2 (adds
repin()). Merge + publish that first, then bump@kunobi/mcp-installerhere so the import resolves.