From d497c5ee97a7c94b826034546b0522e814e633a4 Mon Sep 17 00:00:00 2001 From: Valerio Date: Wed, 22 Jul 2026 12:08:32 +0200 Subject: [PATCH] fix(create-webclaw): add files allowlist so npm never ships secrets npm pack was bundling packages/create-webclaw/.mcpregistry_*_token (the mcp-publisher credential files) into the tarball because the package had no 'files' field and npm did not honor the repo-root .gitignore. Restrict the published package to index.mjs + README.md (matches @webclaw/mcp). Co-Authored-By: Claude Opus 4.8 (1M context) --- packages/create-webclaw/package.json | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/packages/create-webclaw/package.json b/packages/create-webclaw/package.json index 79cc010..9ee61cf 100644 --- a/packages/create-webclaw/package.json +++ b/packages/create-webclaw/package.json @@ -6,6 +6,10 @@ "create-webclaw": "./index.mjs" }, "type": "module", + "files": [ + "index.mjs", + "README.md" + ], "keywords": [ "webclaw", "mcp",