fix: harden MCP and supply chain security

.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    groups:
+      runtime-dependencies:
+        dependency-type: "production"
+      development-dependencies:
+        dependency-type: "development"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5

.github/workflows/junie.yml

@@ -16,6 +16,6 @@ on:
 
 jobs:
   call-workflow-passing-data:
-    uses: jetbrains-junie/junie-workflows/.github/workflows/ej-issue.yml@main
+    uses: jetbrains-junie/junie-workflows/.github/workflows/ej-issue.yml@b4f71597a0a5aaa196d1191efe33f6f77517f792
     with:
       workflow_params: ${{ inputs.workflow_params }}

.github/workflows/release.yml

@@ -12,26 +12,26 @@ on:
         type: boolean
 
 permissions:
-  contents: write
-  issues: write
-  pull-requests: write
-  id-token: write
+  contents: read
 
 jobs:
   test:
     runs-on: ubuntu-latest
-    if: github.event_name != 'push' || !contains(github.event.head_commit.message, '[skip ci]')
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          persist-credentials: false
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v1
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
         with:
-          bun-version: latest
+          bun-version: 1.3.14
 
       - name: Install dependencies
-        run: bun install
+        run: bun install --frozen-lockfile
 
       - name: Build CLI
         run: bun run build
@@ -45,37 +45,44 @@ jobs:
   release:
     runs-on: ubuntu-latest
     needs: test
-    if: github.ref == 'refs/heads/main' && (github.event_name != 'push' || !contains(github.event.head_commit.message, '[skip ci]'))
+    permissions:
+      contents: write
+      id-token: write
+    if: github.ref == 'refs/heads/main' && (github.event_name != 'push' || !startsWith(github.event.head_commit.message, 'chore(release):'))
+    env:
+      NPM_CONFIG_ACCESS: public
+      NPM_CONFIG_PROVENANCE: "true"
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
-          node-version: 'lts/*'
-          registry-url: 'https://registry.npmjs.org'
+          node-version: "22"
+          registry-url: "https://registry.npmjs.org"
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v1
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
         with:
-          bun-version: latest
+          bun-version: 1.3.14
 
       - name: Install dependencies
-        run: bun install
+        run: bun install --frozen-lockfile
 
       - name: Build CLI
         run: bun run build
 
       - name: Update npm for OIDC support
-        run: npm install -g npm@latest
+        run: npm install -g npm@11.16.0
 
       - name: Publish current tagged version
         if: ${{ github.event_name == 'workflow_dispatch' && inputs.publish_current_version }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           PACKAGE_NAME=$(node --input-type=module -e "import pkg from './package.json' with { type: 'json' }; console.log(pkg.name)")
           PACKAGE_VERSION=$(node --input-type=module -e "import pkg from './package.json' with { type: 'json' }; console.log(pkg.version)")
@@ -100,6 +107,4 @@ jobs:
 
       - name: Run semantic-release
         if: ${{ !(github.event_name == 'workflow_dispatch' && inputs.publish_current_version) }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: npx semantic-release
+        run: bun run release

.github/workflows/test.yml

@@ -2,81 +2,86 @@ name: Test and Build
 
 on:
   push:
-    branches: [ main, develop ]
+    branches: [main, develop]
   pull_request:
-    branches: [ main ]
+    branches: [main]
+
+permissions:
+  contents: read
 
 jobs:
   test:
     runs-on: ubuntu-latest
-    if: "!contains(github.event.head_commit.message, '[skip ci]')"
-
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-
-    - name: Setup Bun
-      uses: oven-sh/setup-bun@v1
-      with:
-        bun-version: latest
-
-    - name: Install dependencies
-      run: bun install
-
-    - name: Build CLI
-      run: bun run build
-
-    - name: Run tests
-      run: bun test
-
-    - name: Test CLI executable
-      run: ./dist/index.js --help
-
-    - name: Verify CLI commands
-      run: |
-        ./dist/index.js generate --help
-        ./dist/index.js edit --help
-        ./dist/index.js generate-sequential --help
-        ./dist/index.js edit-sequential --help
+      - name: Checkout code
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          persist-credentials: false
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+        with:
+          bun-version: 1.3.14
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Build CLI
+        run: bun run build
+
+      - name: Run tests
+        run: bun test
+
+      - name: Test CLI executable
+        run: ./dist/index.js --help
+
+      - name: Verify CLI commands
+        run: |
+          ./dist/index.js generate --help
+          ./dist/index.js edit --help
+          ./dist/index.js generate-sequential --help
+          ./dist/index.js edit-sequential --help
 
   validate-implementation:
     runs-on: ubuntu-latest
     needs: test
-    
+
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-
-    - name: Setup Bun
-      uses: oven-sh/setup-bun@v1
-      with:
-        bun-version: latest
-
-    - name: Install dependencies
-      run: bun install
-
-    - name: Build CLI
-      run: bun run build
-
-    - name: Test sync mode parameter
-      run: |
-        # Test that sync mode is available in all commands
-        ./dist/index.js generate --help | grep -q "sync.*mode" || exit 1
-        ./dist/index.js edit --help | grep -q "sync.*mode" || exit 1
-        ./dist/index.js generate-sequential --help | grep -q "sync.*mode" || exit 1
-        ./dist/index.js edit-sequential --help | grep -q "sync.*mode" || exit 1
-
-    - name: Test file upload support
-      run: |
-        # Test that file path support is documented
-        ./dist/index.js edit --help | grep -q "file paths" || exit 1
-        ./dist/index.js edit-sequential --help | grep -q "file paths" || exit 1
-
-    - name: Test parameter validation
-      env:
-        WAVESPEED_API_KEY: test-key
-      run: |
-        # Test validation without API calls
-        ! ./dist/index.js edit 2>&1 | grep -q "Prompt is required" || echo "✓ Prompt validation works"
-        ! ./dist/index.js edit -p "test" 2>&1 | grep -q "Images are required" || echo "✓ Images validation works"
-        ! ./dist/index.js edit -p "test" -i "https://example.com/test.jpg" -s "invalid" 2>&1 | grep -q "Size must be WIDTH" || echo "✓ Size validation works"
+      - name: Checkout code
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          persist-credentials: false
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+        with:
+          bun-version: 1.3.14
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Build CLI
+        run: bun run build
+
+      - name: Test sync mode parameter
+        run: |
+          # Test that sync mode is available in all commands
+          ./dist/index.js generate --help | grep -q "sync.*mode" || exit 1
+          ./dist/index.js edit --help | grep -q "sync.*mode" || exit 1
+          ./dist/index.js generate-sequential --help | grep -q "sync.*mode" || exit 1
+          ./dist/index.js edit-sequential --help | grep -q "sync.*mode" || exit 1
+
+      - name: Test file upload support
+        run: |
+          # Test that file path support is documented for the local CLI
+          ./dist/index.js edit --help | grep -q "file paths" || exit 1
+          ./dist/index.js edit-sequential --help | grep -q "file paths" || exit 1
+
+      - name: Test parameter validation
+        env:
+          WAVESPEED_API_KEY: test-key
+        run: |
+          # Test validation without API calls
+          ./dist/index.js edit 2>&1 | grep -q "Prompt is required"
+          ./dist/index.js edit -p "test" 2>&1 | grep -q "Images are required"
+          ./dist/index.js edit -p "test" -i "https://example.com/test.jpg" -s "invalid" 2>&1 | grep -q "Size must be WIDTH"

.gitignore

@@ -18,16 +18,21 @@ logs
 _.log
 report.[0-9]_.[0-9]_.[0-9]_.[0-9]_.json
 
-# dotenv environment variable files
+# dotenv and local credential/config files
 .env
-.env.development.local
-.env.test.local
-.env.production.local
-.env.local
+.env.*
+!.env.example
+.envrc
+.npmrc
+.wavespeedrc*
+wavespeed.config.*
+!.wavespeedrc.example
+!wavespeed.config.example.*
 
 # caches
 .eslintcache
 .cache
+.pi/orchestrator/runs/
 *.tsbuildinfo
 
 # IntelliJ based IDEs

.releaserc.json

@@ -27,7 +27,7 @@
     "@semantic-release/github",
     ["@semantic-release/git", {
       "assets": ["CHANGELOG.md", "package.json"],
-      "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
+      "message": "chore(release): ${nextRelease.version}\n\n${nextRelease.notes}"
     }]
   ]
 }

CHANGELOG.md

@@ -10,7 +10,7 @@ All notable changes to wavespeed-cli will be documented in this file.
 ### Bug Fixes
 
 * unify CLI and MCP model resolution and submit routing
-* derive submit URLs from the selected model instead of fixed Seedream V4 endpoints
+* derive submit URLs from the selected model instead of fixed legacy default-model endpoints
 * harden config model resolution for canonical ids and cache fallback behavior
 * make live MCP E2E opt-in and stabilize home-config test isolation