[thymikee]

Summary

agent-device.dev builds /.well-known/mcp.json with the npm latest version read at build time. A stable release is a tag push, which builds nothing on Vercel, so the manifest stayed one version behind until the next site change on main.

A redeploy-site job in release.yml waits until npm serves this release or a newer one as latest, then calls the site's Vercel deploy hook, for stable releases only. The hook ("release", production build of main) and the repository secret VERCEL_SITE_DEPLOY_HOOK already exist. The mcp.json route's comment now says how the version follows releases.

3 files: release.yml, its OIDC guard (test/ci/release-workflow.test.ts: the secrets. check now covers the build and publish jobs, and names the deploy hook as the only secret in the workflow), and the mcp.json route comment.

Validation

At 91131f6, pnpm check:affected --run --head HEAD passed every runnable check (fail-open full set), and test/ci/release-workflow.test.ts (3/3), scripts/gate/workflows.test.ts (15/15), the release-plan and release-version tests and lint pass. At 07a27b9 the guard failed because it matched any secrets. (the earlier "15/15" was the gate workflow tests, not this guard). The hook was triggered once by hand: Vercel built a production deployment of main labelled "release" (READY), and agent-device.dev then served mcp.json with 0.21.33, the current npm latest. The job itself first runs on the next stable release.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
agent-device-website	Ready	Preview	Oct 29, 2026 7:08am UTC

[github-actions]

Size Report

Metric	Base	Current	Diff
Installed (including dependencies)	5.56 MB	5.56 MB	0 B
Package (unpacked)	5.56 MB	5.56 MB	0 B
Package (download)	1.69 MB	1.69 MB	+9 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	42.1 ms	41.6 ms	-0.5 ms
CLI --help	87.6 ms	82.9 ms	-4.7 ms

[cubic-dev-ai]

All reported issues were addressed across 2 files

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[thymikee]

The code needs one change at 07a27b9: the release-workflow guard now fails on this head.

test/ci/release-workflow.test.ts:30 runs not.toMatch(/NPM_TOKEN|NODE_AUTH_TOKEN|secrets\./) over the whole release.yml, and this PR adds secrets.VERCEL_SITE_DEPLOY_HOOK at release.yml:247. The rule the test protects is that the npm publisher authenticates through OIDC alone, so it should check the jobs that can reach the npm publish (publish and build), not the whole file. Please keep the NPM_TOKEN/NODE_AUTH_TOKEN check on the full source, scope the secrets. check to those jobs, and name the redeploy-site hook as the one allowed secret. Then rerun test/ci/release-workflow.test.ts and push the change here. I ran the regex on the head file and it matches line 247, so the "15/15 workflow tests" claim in the PR body does not hold for this head.

Coverage is likely red for this reason, because it runs the full vitest suite including that file. Its log is cut off before the test summary, so I confirmed the match by running the regex, not from CI. Smoke Tests fails on an Android emulator snapshot assertion (expected an added line containing "Open automation lab") on a route this diff does not touch, so it looks unrelated. I did not run the unit test locally, call the deploy hook, or fetch agent-device.dev, and the manual-trigger and 0.21.33 claims rest on the PR body only. The new job first runs on the next stable release, and I cannot check from here that the secret exists.

The open inline thread on the secrets\. match in the release-workflow test (#4036 (comment)) still stands and is the same issue as above.

Not blocking, take or leave: the job posts the hook right after publish, but the site build reads registry.npmjs.org/agent-device/latest, so a slow registry could build the previous version with nothing to re-check it. A short bounded wait until npm view agent-device@latest version equals needs.plan.outputs.version before the POST would avoid that. Also, one sentence above the job saying the VERCEL_SITE_DEPLOY_HOOK secret holds the agent-device-website deploy hook for main would help, since no doc names it today.

Before merge, Coverage must pass with the scoped test, and there are no conflicts.

[cubic-dev-ai]

All reported issues were addressed across 2 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[thymikee]

The code looks good at 91131f6. The scoped secrets guard in test/ci/release-workflow.test.ts and the sort -V at-or-past check fix the earlier findings from the previous review. All 31 checks pass, including Coverage, which was red at 07a27b9. There are no conflicts, and I found nothing left to fix in the new changes.

Not blocking, and fine to take or leave: the secretsOf(publish) and secretsOf(build) assertions in the release workflow test are implied by the exact-equality withSecrets assertion below them, and the "after 5 minutes" failure message in release.yml can run longer than that, so "about 5 minutes" or an elapsed-seconds bound would be more accurate.

Both earlier Cubic threads, already resolved, are fixed at this head: the secrets scope test and the sort -V version check.

I read the diff and relied on CI for the tests. I did not run them locally, call the deploy hook, fetch agent-device.dev, or check that the repository secret exists. The job has not run on a real stable release, so the next tag is its first live run.