Prepare v2.25.6-next.1 prerelease with client-free VSIX build (#309)

* Prep v2.25.6-next.1 prerelease; add client-free VSIX build path

- Bump version to 2.25.6-next.1 across all version-bearing files
- Keep .codeql-version at base v2.25.6 (CLI v2.26.0 not yet released)
- Add client-free build:server-and-extension root npm script
- Drop dead client/package.json refs from update-release-version.sh
- Highlight VSIX extension (VS Code/Cursor) as preferred IDE install
- Point Copilot CLI / non-IDE agents to npm and archive installs
- Update CHANGELOG Unreleased with the client-free packaging path

* fix(changelog): add missing PR reference links to Highlights and Infrastructure entries

Co-authored-by: data-douser <70299490+data-douser@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Author: data-douser

CHANGELOG.md

@@ -19,6 +19,7 @@ _Changes on `main` since the latest tagged release that have not yet been includ
 - **Second supply-chain hardening pass for release workflows** — All release-generating workflows now opt out of every cache step, pin runners, strictly validate version inputs, and refuse mid-publish cancellation. See **Security** below for the full inventory. ([#279](https://github.com/advanced-security/codeql-development-mcp-server/pull/279))
 - **First-class Rust toolchain support in CI** — `setup-codeql-environment` now installs a pinned Rust toolchain (default `1.80.0`, via a pinned `dtolnay/rust-toolchain` action with `rust-src`) for any matrix entry that includes `rust`, so the CodeQL rust extractor can expand `format!` / `println!` / `vec!` macros against the standard library on Linux runners. The `query-unit-tests.yml` workflow now passes `languages: ${{ matrix.language }}` so each matrix entry only installs its own runtime. ([#279](https://github.com/advanced-security/codeql-development-mcp-server/pull/279))
 - **Diff-informed analysis & overlay database support** — New MCP primitives help developers make data-flow queries diff-informed (incremental) and build/evaluate overlay databases. A new `diff_informed_analysis_workflow` prompt and two reference resources walk through the query-side opt-in (`observeDiffInformedIncrementalMode`, `getASelectedSourceLocation`, `getASelectedSinkLocation`) and validation via `codeql test run --check-diff-informed`, while `codeql_database_create`, `codeql_database_analyze`, `codeql_query_run`, and `codeql_test_run` gained the corresponding advanced/experimental CLI parameters. ([#304](https://github.com/advanced-security/codeql-development-mcp-server/pull/304))
+- **Client-free, server-and-extension-only VSIX build** — Organizations that mirror the MCP server and VS Code extension packages in their own internal registries can now build and package a VSIX with no dependency on the Go `client/` (which the recent conversion of `client/**` to Go otherwise pulled into the default `npm run build`). A new `build:server-and-extension` root script, combined with the existing `package:vsix`, provides a clean `install` → `build` → `package` path (`npm install` → `npm run build:server-and-extension` → `npm run package:vsix`) that never invokes the Go toolchain. ([#309](https://github.com/advanced-security/codeql-development-mcp-server/pull/309))
 
 ### Added
 
@@ -44,6 +45,10 @@ _Changes on `main` since the latest tagged release that have not yet been includ
 - **`codeql-mcp.queryPackIncludeDirs` / `codeql-mcp.queryPackExcludeDirs` settings** — Two new array settings give explicit, workspace-folder-ordering-independent control over which directories the prompt-driven workflows resolve CodeQL query and pack paths against. `queryPackIncludeDirs` adds extra roots (e.g. a query repository that is not opened as the first folder, or not opened at all); `queryPackExcludeDirs` drops roots (matching directories and anything nested inside them). Absolute entries are used as-is; relative entries are resolved against every workspace folder. Both are folded into the `CODEQL_MCP_WORKSPACE_FOLDERS` and `CODEQL_ADDITIONAL_PACKS` environment variables. ([#308](https://github.com/advanced-security/codeql-development-mcp-server/pull/308))
 - **`codeql-mcp.requireCodeqlWorkspace` setting (default `true`)** — Makes the extension aware of [CodeQL workspaces](https://docs.github.com/en/code-security/concepts/code-scanning/codeql/codeql-workspaces): by default only workspace folders that contain a **top-level `codeql-workspace.yml`** are used as CodeQL query/pack resolution roots, so unrelated repositories opened in the same window are not scanned. `queryPackIncludeDirs` entries are always honored as the explicit opt-in for resolving CodeQL files outside this default pattern. When the setting is `true` but no open folder has a `codeql-workspace.yml` and no `queryPackIncludeDirs` are configured, the extension falls back to using every folder and logs a warning, so existing setups keep working. Set it to `false` to always use every open folder (legacy behavior). ([#308](https://github.com/advanced-security/codeql-development-mcp-server/pull/308))
 
+#### Infrastructure & CI/CD
+
+- **`build:server-and-extension` root script** — New client-free root `npm` script (`npm run build -w server && npm run build -w extensions/vscode`) that builds only the MCP server and the VS Code extension, with no dependency on the Go `client/`. Combined with the existing `package:vsix` script, this provides a complete server-and-extension-only `install` → `build` → `package` workflow for users who do not want (or cannot download) the Go client dependencies introduced by the conversion of `client/**` to Go. The root `README.md` and `docs/getting-started.md` now document this client-free path. ([#309](https://github.com/advanced-security/codeql-development-mcp-server/pull/309))
+
 ### Changed
 
 #### MCP Server Tools

README.md

@@ -55,7 +55,13 @@ Please note that this project is released with a [Contributor Code of Conduct](C
 
 ## Quick Start
 
-### Install via npm (recommended)
+### VS Code extension via VSIX (recommended for IDEs)
+
+If you run `ql-mcp` inside **VS Code** or a compatible fork such as **Cursor**, install the `vscode-codeql-development-mcp-server` extension from a VSIX archive — it bundles the server, auto-registers `ql-mcp`, and discovers the CodeQL CLI. Download the `.vsix` from [GitHub Releases](https://github.com/advanced-security/codeql-development-mcp-server/releases) and install it via `Extensions: Install from VSIX…` in the Command Palette, or build it from source with `npm run package:vsix`. See the [VS Code Extension guide](docs/vscode/extension.md) for details.
+
+For **Copilot CLI** or other non-IDE agentic tools, use one of the methods below.
+
+### Install via npm
 
 No repository clone needed — install from [npmjs.org](https://www.npmjs.com/package/codeql-development-mcp-server):
 
@@ -109,6 +115,8 @@ cd codeql-development-mcp-server
 npm install && npm run build
 ```
 
+> **Server + extension only (no Go client):** `npm run build` also builds the Go `client/` CLI (requires a Go toolchain). To build or package only the server and VS Code extension, use `npm run build:server-and-extension` or `npm run package:vsix` — neither touches `client/`.
+
 ### Verification
 
 1. Restart VS Code

docs/getting-started.md

@@ -10,15 +10,17 @@ This guide covers installation, configuration, and usage of the CodeQL Developme
 
 ## Installation
 
-### VS Code Extension (recommended)
+### VS Code Extension (recommended for IDEs)
 
-The easiest and recommended way to get started is the **VS Code extension** (VSIX
-archive bundle), which automates installation, configuration, and CodeQL CLI
-discovery. Download the `.vsix` from
+If you use `ql-mcp` inside **VS Code** or a compatible fork such as **Cursor**, the
+**VS Code extension** (VSIX archive bundle) is the preferred path — it automates
+installation, configuration, and CodeQL CLI discovery. Download the `.vsix` from
 [GitHub Releases](https://github.com/advanced-security/codeql-development-mcp-server/releases)
-and install it in VS Code via `Extensions: Install from VSIX…` in the Command
-Palette, or build from source (`npm run package:vsix` at the repository root).
-See the [VS Code Extension guide](./vscode/extension.md) for details.
+and install it via `Extensions: Install from VSIX…` in the Command Palette, or build
+it from source with `npm run package:vsix`. See the
+[VS Code Extension guide](./vscode/extension.md) for details.
+
+For Copilot CLI or other non-IDE agentic tools, use one of the methods below.
 
 ### From npm
 

extensions/vscode/package.json

@@ -2,7 +2,7 @@
   "name": "vscode-codeql-development-mcp-server",
   "displayName": "CodeQL Development MCP Server",
   "description": "LLM-assisted development of CodeQL queries, libraries, and tests via #ql-mcp prompts, resources, and tools.",
-  "version": "2.25.6",
+  "version": "2.25.6-next.1",
   "publisher": "advanced-security",
   "license": "LicenseRef-CodeQL-Terms",
   "icon": "media/codeql-icon.png",

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql-development-mcp-server_repo",
-  "version": "2.25.6",
+  "version": "2.25.6-next.1",
   "description": "An MCP server supporting LLM requests for CodeQL development tools and resources.",
   "private": true,
   "type": "module",
@@ -35,6 +35,7 @@
     "build": "npm run build -w server && make -C client build && npm run build -w extensions/vscode",
     "build-and-test": "npm run build:all && npm run test:all",
     "build:all": "npm run tidy && npm run build -w server && make -C client build && npm run build -w extensions/vscode",
+    "build:server-and-extension": "npm run build -w server && npm run build -w extensions/vscode",
     "clean": "make -C client clean && npm run clean -w server -w extensions/vscode && npm run clean:test-dbs",
     "clean:test-dbs": "find server/ql .github/skills -type d -name '*.testproj' -exec rm -rf {} + 2>/dev/null; true",
     "dev:stdio": "npm run dev:stdio -w server",

package.json

@@ -202147,7 +202147,7 @@ init_package_paths();
 init_logger();
 import_dotenv.default.config({ path: resolve14(packageRootDir, ".env"), quiet: true });
 var PACKAGE_NAME = "codeql-development-mcp-server";
-var VERSION = "2.25.6";
+var VERSION = "2.25.6-next.1";
 async function startServer(mode = "stdio") {
   logger.info(`Starting CodeQL Development MCP McpServer v${VERSION} in ${mode} mode`);
   const codeqlBinary = resolveCodeQLBinary();

server/dist/codeql-development-mcp-server.js

@@ -1,6 +1,6 @@
 {
   "name": "codeql-development-mcp-server",
-  "version": "2.25.6",
+  "version": "2.25.6-next.1",
   "description": "An MCP server supporting LLM requests for CodeQL development tools and resources.",
   "main": "dist/codeql-development-mcp-server.js",
   "type": "module",

server/dist/codeql-development-mcp-server.js.map

@@ -1,5 +1,5 @@
 name: advanced-security/ql-mcp-actions-tools-src
-version: 2.25.6
+version: 2.25.6-next.1
 description: 'Queries for codeql-development-mcp-server tools for actions language'
 library: false
 dependencies: