[Feargin]

Summary

UVCS MCP 1.4.0: history, review, and merge preview tools; checkin of selected paths with Unity .meta pairing; exclusive checkout; and an agent skill for Claude Code, Codex, Cursor, OpenCode, and other SKILL.md agents. It also fixes three issues that affect 1.3.0 and earlier. Full notes: docs/releases/v1.4.0.md.

Two commits:

• Add history, review, scoped checkin, checkout, and agent skill: code, tests, skill, docs, dependency updates.
• Release 1.4.0: version markers, every @proanima/uvcs-mcp@… pin, changelog, release notes, readiness evidence, security review.

Fixes in existing tools

• uvcs_diff_file ran cm diff <path>, which opens the GUI diff tool on the user's desktop and hangs until the read timeout. It now diffs the loaded revision (cm cat) against the file on disk. Behavior change: the result has diff instead of the raw stdout.
• uvcs_merge reported success for conflicting merges and left them in progress, which blocked every later checkin. Merges with conflicts are now refused at prepare and again at confirm (MERGE_HAS_CONFLICTS).
• Checkin tokens only fingerprinted status rows, so re-editing an already changed file after prepare went into the checkin unreviewed. Tokens now also bind file size and mtime.
• Item paths with * or ? are rejected (cm expands wildcards itself). Analytics dates are sent as ISO; yyyy/MM/dd was rejected on some locales.

New tools

• Read-only: uvcs_changeset_diff, uvcs_revision_diff, uvcs_file_history, uvcs_annotate, uvcs_branch_list, uvcs_label_list, uvcs_merge_preview (workspace or server-side --to).
• Writes: paths on uvcs_checkin_prepare (auto .meta partners, UNITY_META_NOT_ADDED, --dependencies for new parent folders), uvcs_checkout, uvcs_release_checkout (cm undo --unchanged, never discards edits), paths/scope on uvcs_locks.
• uvcs-mcp skill install and npm run pack:skill (marketplace ZIP).

Dependencies

zod 4.6.7 and transitive updates (body-parser, fast-uri, ip-address) for advisories published after 1.3.0; npm audit reports 0 vulnerabilities.

Validation

• 169 tests (1 POSIX-only, skipped on Windows), lint, syntax check, release metadata check, fake and fleet smoke, packed-tarball smoke (45 tools, skill shipped), skill package validation.
• Mutation checks: disabling each key guard (.meta pairing, file-state binding, merge conflict refusal at prepare and confirm, empty path lists, lock-list fallback, cm cat error handling, folder .meta widening) makes a test fail.
• Live with cm 10.0.16.6656 on a self-hosted server: smoke:plastic and a 37-check write scenario on a disposable repository, including a real merge conflict and a move into a new folder; read-only history tools on a production repository.
• Two independent reviews (code, then docs and skill against the code); all findings addressed.

Not covered live: exclusive locking through a server lock.conf rule (fake cm and unit tests only), and the new commands on cm 11.x clients. CI on Ubuntu, macOS, and Windows runs on this PR.

After merge

Tag v1.4.0 on the merge commit and publish the GitHub Release with docs/releases/v1.4.0.md; that triggers the npm Publish workflow (see docs/publishing.md).

🤖 Generated with Claude Code