chore: dynamic package name in CI and bump to 2.2.8

Author: shleder

.github/workflows/release-npm.yml

@@ -116,12 +116,14 @@ jobs:
           const fs = require('node:fs');
 
           const version = process.env.GITHUB_REF_NAME.replace(/^v/, '');
+          const packageJson = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+          const packageName = packageJson.name;
           const metadata = JSON.parse(
             execFileSync(
               'npm',
               [
                 'view',
-                `toolwall@${version}`,
+                `${packageName}@${version}`,
                 'version',
                 'repository',
                 'homepage',
@@ -153,6 +155,7 @@ jobs:
             '## published release identity',
             '',
             `- tag: \`${process.env.GITHUB_REF_NAME}\``,
+            `- package name: \`${packageName}\``,
             `- package version: \`${metadata.version || version}\``,
             `- npm repository: \`${getField(metadata.repository)}\``,
             `- npm homepage: \`${getField(metadata.homepage)}\``,

CHANGELOG.md

@@ -4,12 +4,13 @@ All notable changes to this project will be documented in this file.
 The format is based on Keep a Changelog and the project follows semantic versioning.
 
 
-## 2.2.7 - 2026-05-13
+## 2.2.8 - 2026-05-13
 - Fixes critical security regression in stdio path (0 false negatives in benchmark)
 - Aligns stdio and HTTP security validators (AST, Scope, Color, Preflight)
 - Adds persistent security event logging in SQLite (7-day history)
 - Implements resilient multi-target Gateway mode with Zod validation
 - Adds "Clear History" and Target Status indicators to UI Dashboard
+- Fixes release pipeline package-name lookup by reading the npm package name dynamically from package.json
 
 ## 2.2.6 - 2026-04-07
 

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@maksiph14/toolwall",
-  "version": "2.2.7",
+  "version": "2.2.8",
   "description": "Fail-closed stdio firewall for risky local MCP JSON-RPC tool calls",
   "main": "dist/lib.js",
   "exports": {

package.json

@@ -13,7 +13,6 @@ const packageJsonPath = path.join(repoRoot, 'package.json');
 const demoTargetPath = path.join(repoRoot, 'examples', 'demo-target.js');
 const npmCliPath = path.join(path.dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js');
 const npxCliPath = path.join(path.dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npx-cli.js');
-const publishedCliName = 'toolwall';
 const tempPackDirPath = fs.mkdtempSync(path.join(os.tmpdir(), 'mcp-pack-smoke-'));
 const npmInvocation = process.platform === 'win32'
   ? {
@@ -35,10 +34,11 @@ const npxInvocation = process.platform === 'win32'
     };
 
 const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+const publishedCliName = Object.keys(packageJson.bin ?? {})[0];
 const cliPath = packageJson.bin?.[publishedCliName];
 
 if (typeof cliPath !== 'string') {
-  throw new Error(`Missing ${publishedCliName} bin entry in package.json.`);
+  throw new Error('Missing bin entry in package.json.');
 }
 
 const formatFailure = (label, command, args, stdout, stderr, message) => {