---
summary: "Adopt @cyanheads/mcp-ts-core ^0.10.6: framework SQL system-catalog gate, stringbool env flags, enrich.total/truncated helpers. MCPB bundle hygiene: clean-mcpb.ts strips dependency agent-docs, lint-packaging bundle-content + identity checks. Dockerfile healthcheck + version label."
breaking: false
security: false
---

# 0.4.4 — 2026-06-12

## Changed

- **`@cyanheads/mcp-ts-core` `^0.9.21` → `^0.10.6`** — adopt the framework SQL gate's `denySystemCatalogs` query option and the `ctx.enrich.total()` / `ctx.enrich.truncated()` enrichment helpers.
- **Canvas SQL system-catalog denial moved to the framework gate** — `CanvasBridge.query` now passes `denySystemCatalogs: true` to the framework `sqlGate` (≥ 0.10.4) instead of pre-screening SQL locally. The `system_catalog_access` reason code is preserved and propagates unchanged to `bls_dataframe_query`.
- **`bls_search_series` enrichment migrated to framework helpers** — `totalFound` renamed to `totalCount`; new `truncated`, `shown`, and `cap` fields populated via `ctx.enrich.total()` and `ctx.enrich.truncated()` when the candidate pool exceeds the returned limit. The `capped` description now references `totalCount`.
- **Env boolean flags use `z.stringbool()`** — `catalogIncludeOes`, `dataframeDropEnabled`, `observationsMirrorEnabled`, and `observationsMirrorFallbackLive` switch from `.enum(['true','false']).transform()` to `z.stringbool()` with native boolean defaults, so `"false"`/`"0"`/`"no"`/`"off"` disable correctly and invalid values are rejected.
- **`createApp()` declares explicit `name` and `title`** — both set to `bls-labor-mcp-server` so the served identity is the unscoped repo name, not the npm scope.
- **`.codex-plugin` `interface.displayName`** — `@cyanheads/bls-labor-mcp-server` → `bls-labor-mcp-server`.
- **`.mcpbignore` patterns anchored to root** — dev-directory and config excludes (`/skills/`, `/.claude/`, `/.agents/`, `/Dockerfile`, `/bun.lock`, etc.) now carry a leading `/` so they no longer also strip nested runtime paths like `node_modules/*/skills/`.
- **`@types/node` `^25.9.1` → `^25.9.3`**.

## Added

- **`scripts/clean-mcpb.ts`** — post-pack bundle cleaner wired into the `bundle` script: runs `mcpb clean` (dev-dependency prune) then exact-name strips agent-doc entries (`skills/`, `.claude/`, `.agents/`, `SKILL.md`) nested under `node_modules/` that root-anchored `.mcpbignore` patterns cannot reach, and verifies zero remain.
- **`lint-packaging.ts` bundle-content and identity checks** — checks 5–7 reject `.mcpbignore` patterns that miss a root dev directory or strip critical runtime paths; check 8 asserts a built `dist/*.mcpb` carries no `node_modules/**` agent-doc entries; check 9 enforces that `createApp()` `name`/`title` and manifest `display_name` equal the unscoped package name.
- **`check-framework-antipatterns.ts` rule 4** — flags `z.coerce.boolean()` on env flags (`Boolean("false") === true` makes them un-disable-able; use `z.stringbool()`). Matched comment lines are skipped so JSDoc naming the pattern doesn't false-positive.
- **Dockerfile `HEALTHCHECK` and version metadata** — a Bun-native `fetch` healthcheck against `/healthz`, plus an `APP_VERSION` build arg feeding `org.opencontainers.image.version`.

## Removed

- **`src/services/canvas-bridge/sql-gate-extras.ts`** and its test — the local `assertNoSystemCatalogAccess` screen is superseded by the framework gate's `denySystemCatalogs` option.