Fix the startup crash on a clean install; cut 1.2.1

[yosriady]

The bug

Every published version of @formo/cli crashes on startup for anyone who installs it. Reproduced with npm and pnpm, on 1.1.1 and 1.2.0:

$ npm i @formo/cli && formo --version
incur/dist/Mcp.js:1
import { McpServer, StdioServerTransport } from '@modelcontextprotocol/server';
                    ^^^^^^^^^^^^^^^^^^^^
SyntaxError: The requested module '@modelcontextprotocol/server'
             does not provide an export named 'StdioServerTransport'

npx @formo/cli is affected too. This is not a 1.2.0 regression — it went live the moment the upstream 2.0.0 was published.

Root cause

incur@0.3.25 declares "@modelcontextprotocol/server": "^2.0.0-alpha.2". Our pnpm-lock.yaml pins 2.0.0-alpha.2, which still exports StdioServerTransport. The 2.0.0 stable release dropped that export and satisfies the caret range. Lockfiles don't ship to consumers, so every fresh install resolves to the broken version.

Locally everything looked fine: pnpm replays the lockfile, and minimumReleaseAge: 2880 in pnpm-workspace.yaml holds new releases back two days.

The fix

Bump incur 0.3.25 → 0.4.26. Upstream fixed this properly by pinning the dependency to an exact 2.0.0-alpha.4, so consumers cannot drift. That's better than pinning a direct dependency here to work around the range.

Re-cut the kebab-case patch. Still needed on 0.4.26 — option definitions now render kebab-case upstream, but examples, usage lines, CTAs and skill tables still emit the raw camelCase key. The four sites moved (formatCta is now internal/cta.js), so the patch is regenerated against the new version and patches/incur.patch is replaced by patches/incur@0.4.26.patch.

Preventing a recurrence

New smoke CI job: packs the tarball, installs it with npm in a temp dir, and asserts the binary starts and renders help. Every existing job runs pnpm install --frozen-lockfile, which replays pinned transitive versions and so structurally cannot catch a consumer-facing resolution break. Nothing in the pipeline installed the package the way a user does.

A rejected TEST_TOKEN now fails the suite instead of skipping. Skipping made an expired credential indistinguishable from a healthy run — which is how CI reported green across the entire canonical-filter migration (#29–#33) without ever calling the API. An absent token still skips, so fork PRs stay green.

Scenario	Before	After
Valid token	189 passing / 3 pending	189 passing / 3 pending
Token present but rejected	174 passing / 18 pending ✅	12 failing ❌
No token (fork PR)	174 passing / 18 pending ✅	174 passing / 18 pending ✅

Verification

Packed 1.2.1, installed it with npm in a clean directory:

• resolves @modelcontextprotocol/server@2.0.0-alpha.4
• formo --version → 1.2.1
• formo analytics kpis --date-from 2026-07-01 --date-to 2026-07-31 returns live data
• formo profiles search --filters '[{"field":"users.net_worth_usd","op":"gt","value":1000}]' returns a live profile

pnpm lint, pnpm typecheck and pnpm build all pass.

Known issue, not fixed here

The kebab-case patch is dev-only — it never reaches consumers, so the published CLI's --help examples still print --dateFrom rather than --date-from. Pre-existing and cosmetic, but it means the patch doesn't help the people it was written for. Worth an upstream fix in incur.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	incur@​0.4.26

View full report