release: v0.10.3, because npm and the Marketplace still showed the old project

CHANGELOG.md

@@ -6,6 +6,40 @@ this file.
 This project follows the spirit of
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## v0.10.3 - 2026-08-06
+
+Published so that two pages people arrive on stop describing a project from two
+months ago. npm packages are immutable, so nothing in v0.10.2 could be corrected
+in place.
+
+### Documentation
+
+- **The npm page for `mergewarden`** is rendered from `packages/cli/README.md`,
+  which was worse than out of date. It told people to run
+  `npx mergewarden@0.8.0`, never mentioned `triage` at all, and repeated the
+  claim that "Authentication is optional for public repositories", which was
+  corrected in the main README and is false for `triage`: 60 unauthenticated
+  requests an hour does not cover one queue.
+
+  Rewritten, with exit codes now stated per command because they differ. `scan`
+  and `replay` return `2` on an incomplete analysis; `triage` returns `1`,
+  because a partly-read queue is still worth printing. The first draft of that
+  file merged the two and would have published a wrong claim.
+
+- **The GitHub Marketplace listing** takes its description from `action.yml`,
+  which still read "Checkout-free policy gate for AI-generated pull requests".
+  The action `name` is deliberately unchanged: the Marketplace slug is derived
+  from it, so renaming would orphan the existing listing URL.
+
+- The npm package description, also rendered by npm, had the same old wording.
+
+- `docs/roadmap.md` stopped at "Shipped in v0.3.1" while the project was on
+  v0.10.2, so seven releases were invisible and the page read as something that
+  stalled in spring.
+
+Unchanged on purpose: the older version strings in `docs/demo-prs.md`, which
+record which build produced which verified external run.
+
 ## v0.10.2 - 2026-08-06
 
 ### Fixed

README.md

@@ -60,7 +60,7 @@ jobs:
   mergewarden:
     runs-on: ubuntu-latest
     steps:
-      - uses: sjh9714/mergewarden@v0.10.2
+      - uses: sjh9714/mergewarden@v0.10.3
         with:
           comment: auto
 ```
@@ -144,7 +144,7 @@ with **no scopes selected** is enough, since nothing here writes.
 
 ```bash
 export GH_TOKEN=github_pat_...
-npx --yes mergewarden@0.10.2 triage owner/repository
+npx --yes mergewarden@0.10.3 triage owner/repository
 ```
 
 ```

README.zh-CN.md

@@ -45,7 +45,7 @@ Next: Review the agent instruction/tooling change before merging.
 不需要令牌、不需要仓库、不联网，先看看它能抓到什么：
 
 ```bash
-npx --yes mergewarden@0.10.2 demo
+npx --yes mergewarden@0.10.3 demo
 ```
 
 这条命令会分析一个内置在 CLI 里的示例 PR，用的是**默认策略**——也就是说，它输出的 13 条检查结果，就是零配置安装时你实际会得到的东西。
@@ -57,8 +57,8 @@ _上图是真实的 `npx` 执行（用 `head` 截断以便完整显示开头）
 然后扫描一个真实的 PR，用 `owner/repo#number` 或完整 URL 都可以：
 
 ```bash
-npx --yes mergewarden@0.10.2 scan owner/repository#123
-npx --yes mergewarden@0.10.2 scan https://github.com/owner/repository/pull/123
+npx --yes mergewarden@0.10.3 scan owner/repository#123
+npx --yes mergewarden@0.10.3 scan https://github.com/owner/repository/pull/123
 ```
 
 私有仓库或需要更高 API 速率限制时，用 `GH_TOKEN` 或 `GITHUB_TOKEN` 环境变量。MergeWarden 有意不提供传令牌的命令行参数。
@@ -84,7 +84,7 @@ jobs:
   mergewarden:
     runs-on: ubuntu-latest
     steps:
-      - uses: sjh9714/mergewarden@v0.10.2
+      - uses: sjh9714/mergewarden@v0.10.3
         with:
           comment: auto
 ```

docs/cli.md

@@ -17,7 +17,7 @@ mergewarden --version
 Run without installing:
 
 ```bash
-npx --yes mergewarden@0.10.2 scan owner/repository#123
+npx --yes mergewarden@0.10.3 scan owner/repository#123
 ```
 
 ## Demo

docs/getting-started.md

@@ -9,7 +9,7 @@ You can run MergeWarden against any public pull request without installing
 anything and without a token:
 
 ```bash
-npx --yes mergewarden@0.10.2 scan owner/repository#123
+npx --yes mergewarden@0.10.3 scan owner/repository#123
 ```
 
 Try it on a pull request you already know well. If the report tells you nothing
@@ -21,7 +21,7 @@ open pull request and lists only the ones with something a maintainer checks by
 hand:
 
 ```bash
-npx --yes mergewarden@0.10.2 triage owner/repository
+npx --yes mergewarden@0.10.3 triage owner/repository
 ```
 
 It needs no write access and writes nothing back, but it does need `GH_TOKEN`
@@ -57,7 +57,7 @@ jobs:
   mergewarden:
     runs-on: ubuntu-latest
     steps:
-      - uses: sjh9714/mergewarden@v0.10.2
+      - uses: sjh9714/mergewarden@v0.10.3
         with:
           comment: auto
 ```

docs/history/releases/release-notes-v0.10.3.md

@@ -0,0 +1,46 @@
+# v0.10.3
+
+**Released 2026-08-06.**
+
+A documentation release. No behaviour changed.
+
+## Why it needed a version number
+
+npm packages are immutable, and the GitHub Marketplace listing reads its
+description from `action.yml` at the released tag. Both were still describing
+the project as it was two months ago, and neither could be corrected without
+publishing again.
+
+## The npm page
+
+`npmjs.com/package/mergewarden` renders `packages/cli/README.md`, which was
+worse than out of date:
+
+- it told people to run `npx mergewarden@0.8.0`, two releases behind
+- it never mentioned `triage`, which is the reason 0.10.x exists
+- it said "Authentication is optional for public repositories", which is false
+  for `triage`, since 60 unauthenticated requests an hour does not cover one
+  queue
+
+Rewritten. Exit codes are now given per command, because they differ: `scan` and
+`replay` return `2` on an incomplete analysis, while `triage` returns `1`, since
+a partly-read queue is still worth printing.
+
+## The Marketplace listing
+
+Its description came from `action.yml`, which still read "Checkout-free policy
+gate for AI-generated pull requests". It now describes the check the README
+leads with.
+
+The action's `name` is deliberately unchanged. The Marketplace slug is derived
+from it, so renaming would orphan the existing listing URL for no gain.
+
+## Also
+
+`docs/roadmap.md` stopped at "Shipped in v0.3.1" while the project was on
+v0.10.2. Seven releases were invisible.
+
+The older version strings in `docs/demo-prs.md` are unchanged on purpose: they
+record which build produced which verified external run.
+
+The full list is in the [changelog](../../../CHANGELOG.md).

package.json

@@ -1,6 +1,6 @@
 {
   "name": "mergewarden-repo",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "private": true,
   "type": "module",
   "packageManager": "pnpm@11.5.0",

packages/action/dist/index.cjs

@@ -51617,7 +51617,7 @@ async function loadGitHubAnalysis(api, target, options) {
 }
 
 // src/version.ts
-var MERGEWARDEN_VERSION = "0.10.2";
+var MERGEWARDEN_VERSION = "0.10.3";
 
 // src/run.ts
 var MERGEWARDEN_COMMENT_MARKER = "<!-- mergewarden-report -->";

packages/action/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mergewarden/action",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "private": true,
   "type": "module",
   "files": [

packages/action/src/version.ts

@@ -1 +1 @@
-export const MERGEWARDEN_VERSION = "0.10.2";
+export const MERGEWARDEN_VERSION = "0.10.3";

packages/cli/README.md

@@ -13,7 +13,7 @@ or a whole queue, from your terminal.
 ## Read a whole queue
 
 ```console
-npx mergewarden@0.10.2 triage owner/repository
+npx mergewarden@0.10.3 triage owner/repository
 ```
 
 ```
@@ -35,7 +35,7 @@ it only half saw.
 ## Scan one pull request
 
 ```console
-npx mergewarden@0.10.2 scan owner/repository#123
+npx mergewarden@0.10.3 scan owner/repository#123
 ```
 
 Full pull request URLs are accepted too. A single public pull request works

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mergewarden",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "private": false,
   "type": "module",
   "description": "Reports what a pull request changed that a maintainer normally checks by hand, starting with the files coding agents read as instructions",

packages/cli/src/version.ts

@@ -1 +1 @@
-export const MERGEWARDEN_VERSION = "0.10.2";
+export const MERGEWARDEN_VERSION = "0.10.3";

packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mergewarden/core",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "private": true,
   "type": "module",
   "exports": {

packages/core/src/version.ts

@@ -1 +1 @@
-export const MERGEWARDEN_VERSION = "0.10.2";
+export const MERGEWARDEN_VERSION = "0.10.3";

packages/github/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mergewarden/github",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "private": true,
   "type": "module",
   "exports": {

packages/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mergewarden-mcp",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "description": "MCP server that checks whether a coding agent's changes stayed inside the scope it was given",
   "license": "MIT",
   "type": "module",

packages/mcp/server.json

@@ -2,7 +2,7 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.sjh9714/mergewarden",
   "description": "Check whether a coding agent's changes stayed inside the scope it was given.",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "repository": {
     "url": "https://github.com/sjh9714/mergewarden",
     "source": "github"
@@ -11,7 +11,7 @@
     {
       "registryType": "npm",
       "identifier": "mergewarden-mcp",
-      "version": "0.10.2",
+      "version": "0.10.3",
       "transport": {
         "type": "stdio"
       }

packages/mcp/src/version.ts

@@ -1 +1 @@
-export const MERGEWARDEN_VERSION = "0.10.2";
+export const MERGEWARDEN_VERSION = "0.10.3";

templates/mergewarden-observe.yml

@@ -12,4 +12,4 @@ jobs:
   mergewarden:
     runs-on: ubuntu-latest
     steps:
-      - uses: sjh9714/mergewarden@v0.10.2
+      - uses: sjh9714/mergewarden@v0.10.3