codeh007 · codeh007 · Aug 29, 2026 · Aug 28, 2026 · Aug 29, 2026
diff --git a/.github/workflows/release-mtm-connect.yml b/.github/workflows/release-mtm-connect.yml
@@ -0,0 +1,135 @@
+name: release-mtm-connect
+run-name: Release mtm-connect ${{ github.ref_name }}
+
+on:
+  push:
+    tags:
+      - 'mtm-connect-v[0-9]*.[0-9]*.[0-9]*'
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: mtm-connect-npm-publish
+  cancel-in-progress: false
+
+env:
+  PACKAGE_NAME: mtm-connect
+  PACKAGE_DIR: packages/mtm-connect
+  TAG_PREFIX: mtm-connect-v
+
+jobs:
+  publish:
+    name: Pack, publish, and read back mtm-connect
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout tagged main commit
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 11.7.0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22.19.0'
+          registry-url: https://registry.npmjs.org
+          cache: pnpm
+
+      - name: Enable Corepack
+        run: corepack enable
+
+      - name: Verify pnpm version
+        run: test "$(pnpm --version)" = 11.7.0
+
+      - name: Install
+        run: pnpm install --frozen-lockfile
+
+      - name: Validate tag and main ancestry
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          package_version="$(node -p "require('./${PACKAGE_DIR}/package.json').version")"
+          test "$RELEASE_TAG" = "${TAG_PREFIX}${package_version}"
+          git fetch --no-tags origin main
+          git merge-base --is-ancestor "$GITHUB_SHA" origin/main
+          printf 'PACKAGE_VERSION=%s\n' "$package_version" >> "$GITHUB_ENV"
+
+      - name: Check browser extension and manifest pin
+        run: |
+          set -euo pipefail
+          pnpm --filter mtm-connect run check
+          package_version="$(node -p "require('./${PACKAGE_DIR}/package.json').version")"
+          manifest_version="$(sed -n '/id: "mtm-connect"/{n;s/.*version: "\([^\"]*\)".*/\1/p;}' packages/mtmharness/src/features/secondary/manifest.ts)"
+          expected_integrity="$(sed -n '/id: "mtm-connect"/{n;n;n;s/.*clientIntegrity: "\([^\"]*\)".*/\1/p;}' packages/mtmharness/src/features/secondary/manifest.ts)"
+          test "$manifest_version" = "$package_version"
+          local_integrity="sha256-$(openssl dgst -sha256 -binary packages/mtm-connect/lib/client.js | base64 -w0)"
+          test "$local_integrity" = "$expected_integrity"
+          printf 'EXPECTED_INTEGRITY=%s\n' "$expected_integrity" >> "$GITHUB_ENV"
+
+      - name: Pack release tarball
+        id: pack
+        run: |
+          set -euo pipefail
+          pack_dir="$RUNNER_TEMP/mtm-connect"
+          mkdir -p "$pack_dir"
+          pnpm --filter mtm-connect pack --pack-destination "$pack_dir"
+          tarball="$(find "$pack_dir" -maxdepth 1 -type f -name "${PACKAGE_NAME}-*.tgz" -print -quit)"
+          test -n "$tarball"
+          local_integrity="sha512-$(openssl dgst -sha512 -binary "$tarball" | base64 -w0)"
+          printf 'tarball=%s\n' "$tarball" >> "$GITHUB_OUTPUT"
+          printf 'LOCAL_INTEGRITY=%s\n' "$local_integrity" >> "$GITHUB_ENV"
+
+      - name: Lint package metadata
+        run: pnpm dlx publint run "${{ steps.pack.outputs.tarball }}" --strict
+
+      - name: Preflight registry and token
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          set -euo pipefail
+          test -n "${NODE_AUTH_TOKEN:-}"
+          npm whoami --registry=https://registry.npmjs.org >/dev/null
+          status="$(curl --silent --show-error --location --output /dev/null --write-out '%{http_code}' "https://registry.npmjs.org/${PACKAGE_NAME}/${PACKAGE_VERSION}")"
+          test "$status" = 404
+
+      - name: Publish with provenance
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish "${{ steps.pack.outputs.tarball }}" --access public --provenance --ignore-scripts
+
+      - name: Read back npm and CDN artifacts
+        run: |
+          set -euo pipefail
+          remote="$RUNNER_TEMP/mtm-connect-client.js"
+          for attempt in $(seq 1 12); do
+            published_integrity="$(npm view "${PACKAGE_NAME}@${PACKAGE_VERSION}" dist.integrity --json 2>/dev/null | jq -r . || true)"
+            published_version="$(npm view "${PACKAGE_NAME}@${PACKAGE_VERSION}" version --json 2>/dev/null | jq -r . || true)"
+            curl --fail --silent --show-error --location --output "$remote" "https://unpkg.com/${PACKAGE_NAME}@${PACKAGE_VERSION}/lib/client.js" || true
+            remote_integrity=""
+            test -f "$remote" && remote_integrity="sha256-$(openssl dgst -sha256 -binary "$remote" | base64 -w0)"
+            if test "$published_integrity" = "$LOCAL_INTEGRITY" && test "$published_version" = "$PACKAGE_VERSION" && test "$remote_integrity" = "$EXPECTED_INTEGRITY" && cmp packages/mtm-connect/lib/client.js "$remote"; then
+              break
+            fi
+            if test "$attempt" -eq 12; then
+              echo "npm/CDN artifact read-back did not converge after ${attempt} attempts" >&2
+              exit 1
+            fi
+            sleep 5
+          done
+          {
+            echo '### npm release evidence'
+            echo
+            echo "- package: ${PACKAGE_NAME}@${PACKAGE_VERSION}"
+            echo "- tag: ${GITHUB_REF_NAME}"
+            echo "- integrity: ${published_integrity}"
+            echo '- provenance: requested with npm publish --provenance'
+          } >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/release-mtmharness.yml b/.github/workflows/release-mtmharness.yml
@@ -68,18 +68,30 @@ jobs:
           set -euo pipefail
           pnpm --filter mtmharness run check
           pnpm --filter mtmcanvas run check
-          # The pinned Canvas artifact must already be published before mtmharness.
+          pnpm --filter mtm-connect run check
+          # The pinned secondary artifacts must already be published before mtmharness.
           canvas_version="$(node -p "require('./packages/mtmcanvas/package.json').version")"
-          expected_integrity="$(sed -n 's/.*clientIntegrity: \"\([^\"]*\)\".*/\1/p' packages/mtmharness/src/features/secondary/manifest.ts)"
+          canvas_integrity="$(sed -n '/id: "mtmcanvas"/{n;n;n;s/.*clientIntegrity: "\([^\"]*\)".*/\1/p;}' packages/mtmharness/src/features/secondary/manifest.ts)"
           local_integrity="sha256-$(openssl dgst -sha256 -binary packages/mtmcanvas/lib/client.js | base64 -w0)"
-          test -n "$expected_integrity"
-          test "$local_integrity" = "$expected_integrity"
+          test -n "$canvas_integrity"
+          test "$local_integrity" = "$canvas_integrity"
           test "$(npm view "mtmcanvas@${canvas_version}" version --json | jq -r .)" = "$canvas_version"
           remote="$RUNNER_TEMP/mtmcanvas-client.js"
           curl --fail --silent --show-error --output "$remote" "https://unpkg.com/mtmcanvas@${canvas_version}/lib/client.js"
           remote_integrity="sha256-$(openssl dgst -sha256 -binary "$remote" | base64 -w0)"
-          test "$remote_integrity" = "$expected_integrity"
+          test "$remote_integrity" = "$canvas_integrity"
           cmp "packages/mtmcanvas/lib/client.js" "$remote"
+          connect_version="$(node -p "require('./packages/mtm-connect/package.json').version")"
+          connect_integrity="$(sed -n '/id: "mtm-connect"/{n;n;n;s/.*clientIntegrity: "\([^\"]*\)".*/\1/p;}' packages/mtmharness/src/features/secondary/manifest.ts)"
+          local_integrity="sha256-$(openssl dgst -sha256 -binary packages/mtm-connect/lib/client.js | base64 -w0)"
+          test -n "$connect_integrity"
+          test "$local_integrity" = "$connect_integrity"
+          test "$(npm view "mtm-connect@${connect_version}" version --json | jq -r .)" = "$connect_version"
+          remote="$RUNNER_TEMP/mtm-connect-client.js"
+          curl --fail --silent --show-error --output "$remote" "https://unpkg.com/mtm-connect@${connect_version}/lib/client.js"
+          remote_integrity="sha256-$(openssl dgst -sha256 -binary "$remote" | base64 -w0)"
+          test "$remote_integrity" = "$connect_integrity"
+          cmp "packages/mtm-connect/lib/client.js" "$remote"
 
       - name: Pack release tarball
         id: pack

diff --git a/package.json b/package.json
@@ -7,7 +7,7 @@
   "scripts": {
     "build": "pnpm --filter mtmharness run build",
     "demo": "pnpm --filter mtmharness run dev",
-    "check": "pnpm --filter mtmharness run check && pnpm --filter mtmcanvas run check",
+    "check": "pnpm --filter mtmharness run check && pnpm --filter mtmcanvas run check && pnpm --filter mtm-connect run check",
     "pack:mtmharness": "pnpm --filter mtmharness run pack:check"
   },
   "devDependencies": { "typescript": "6.0.3" }

diff --git a/packages/mtm-connect/LICENSE b/packages/mtm-connect/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 codeh007
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/packages/mtm-connect/README.md b/packages/mtm-connect/README.md
@@ -0,0 +1,13 @@
+# mtm-connect
+
+Browser-only mock frontend extension for mtmharness.
+
+The package is not a standard DSH plugin. It publishes one self-contained native ESM artifact at lib/client.js, exporting mount(context). mtmharness owns runtime loading, exact version, SHA-256 integrity, enable/disable setting, and cleanup.
+
+The current UI models device and execution-world connections in memory. It supports selecting a connection, refreshing mock state, and toggling a connection online or offline. No backend, filesystem, token, or DSH service is required by the artifact.
+
+## Development
+
+    pnpm --filter mtm-connect run check
+
+Install mtmharness into the DSH Web profile. The MTM Connect setting loads this artifact at runtime; do not install mtm-connect with dsh plugin.
diff --git a/packages/mtm-connect/package.json b/packages/mtm-connect/package.json
@@ -0,0 +1,67 @@
+{
+  "name": "mtm-connect",
+  "version": "0.2.0",
+  "description": "Browser-only mock device connection frontend extension for mtmharness.",
+  "type": "module",
+  "engines": {
+    "node": ">=22.19.0",
+    "pnpm": ">=11.7.0"
+  },
+  "main": "./lib/client.js",
+  "types": "./lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "import": "./lib/client.js",
+      "default": "./lib/client.js"
+    },
+    "./client": {
+      "types": "./lib/types/client/index.d.ts",
+      "import": "./lib/client.js",
+      "default": "./lib/client.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "mtmharness": {
+    "secondary": {
+      "id": "mtm-connect",
+      "apiVersion": 1,
+      "client": "./lib/client.js"
+    }
+  },
+  "files": [
+    "lib/client.js",
+    "lib/types/**/*.d.ts",
+    "README.md",
+    "package.json",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "node scripts/build.mjs",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "check": "pnpm run typecheck && pnpm run test && pnpm run build && pnpm run pack:check",
+    "pack:check": "node scripts/pack-check.mjs",
+    "prepack": "pnpm run build"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/codeh007/mtmdsh.git",
+    "directory": "packages/mtm-connect"
+  },
+  "devDependencies": {
+    "@types/node": "22.20.1",
+    "@types/react": "~18.3.1",
+    "@types/react-dom": "~18.3.0",
+    "esbuild": "0.28.2",
+    "jsdom": "30.0.1",
+    "react": "18.3.1",
+    "react-dom": "18.3.1",
+    "typescript": "6.0.3",
+    "vitest": "4.1.11"
+  }
+}
diff --git a/packages/mtm-connect/scripts/build.mjs b/packages/mtm-connect/scripts/build.mjs
@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, rmSync } from "node:fs";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { build } from "esbuild";
+
+const packageRoot = fileURLToPath(new URL("..", import.meta.url));
+const libRoot = resolve(packageRoot, "lib");
+const tsc = resolve(packageRoot, "node_modules/.bin/tsc");
+
+rmSync(libRoot, { recursive: true, force: true });
+mkdirSync(libRoot, { recursive: true });
+if (!existsSync(tsc)) throw new Error("mtm-connect build: local TypeScript executable is missing");
+execFileSync(tsc, ["--project", resolve(packageRoot, "tsconfig.json")], { cwd: packageRoot, stdio: "inherit" });
+
+await build({
+  entryPoints: [resolve(packageRoot, "src/client/index.ts")],
+  outfile: resolve(libRoot, "client.js"),
+  bundle: true,
+  format: "esm",
+  platform: "browser",
+  target: "es2022",
+  legalComments: "none",
+  logLevel: "info",
+});
+const artifact = await import(resolve(libRoot, "client.js"));
+if (typeof artifact.mount !== "function") throw new Error("mtm-connect build: client artifact must export mount(context)");
+
+console.log("built mtm-connect browser ESM artifact");
diff --git a/packages/mtm-connect/scripts/pack-check.mjs b/packages/mtm-connect/scripts/pack-check.mjs
@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, readFileSync, readdirSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { fileURLToPath } from "node:url";
+
+const packageRoot = fileURLToPath(new URL("..", import.meta.url));
+const destination = mkdtempSync(join(tmpdir(), "mtm-connect-pack-"));
+try {
+  execFileSync("pnpm", ["pack", "--pack-destination", destination], { cwd: packageRoot, stdio: "inherit" });
+  const tarball = readdirSync(destination).find((name) => name.endsWith(".tgz"));
+  if (tarball === undefined) throw new Error("mtm-connect pack: pnpm did not create a tarball");
+  const entries = execFileSync("tar", ["-tzf", join(destination, tarball)], { encoding: "utf8" }).split("\n");
+  for (const entry of ["package/LICENSE", "package/README.md", "package/package.json", "package/lib/client.js", "package/lib/types/index.d.ts", "package/lib/types/client/index.d.ts"]) {
+    if (!entries.includes(entry)) throw new Error("mtm-connect pack: missing " + entry);
+  }
+  if (entries.some((entry) => entry.includes(".test."))) throw new Error("mtm-connect pack: test files must not ship");
+  const source = readFileSync(join(packageRoot, "lib/client.js"), "utf8");
+  for (const forbidden of [/^\s*import\s/m, /require\(["']node:/, /require\(["'](?:fs|child_process)/, "@deepseek-ai/", "__ModuleLoader__"]) {
+    if (forbidden instanceof RegExp ? forbidden.test(source) : source.includes(forbidden)) throw new Error("mtm-connect pack: client artifact is not self-contained: " + forbidden);
+  }
+  if (!source.includes("export {")) throw new Error("mtm-connect pack: client artifact does not export mount");
+} finally {
+  rmSync(destination, { recursive: true, force: true });
+}