Integrate desktop authoring line into core TMCP

.github/workflows/ci.yml

@@ -4,6 +4,7 @@ on:
   pull_request:
     branches:
       - main
+      - feature/desktop
 
 jobs:
   build:
@@ -13,16 +14,16 @@ jobs:
       matrix:
         node-version: ['>=22.7.5 <23', '24.x']
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
 
       - name: Set up Docker
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Install dependencies
         run: npm ci
@@ -36,6 +37,14 @@ jobs:
       - name: Build
         run: npm run build
 
+      # --dirty: the plain build:desktop CLEANS ./build first, deleting the
+      # build/index.js the default build just produced — the e2e suites spawn
+      # `node build/index.js` children, which then die pre-handshake
+      # ("Connection closed") until server.test.ts happens to rebuild it
+      # mid-pool. Root-caused 2026-07-15 on the resync PR (#504).
+      - name: Build desktop variant
+        run: npm run build:desktop:dirty
+
       - name: Build Docker image
         run: npm run build:docker
 
@@ -115,7 +124,7 @@ jobs:
 
       - name: Upload artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: artifacts-node${{ matrix.node-version == '>=22.7.5 <23' && '22.x' || matrix.node-version }}
           if-no-files-found: error

.github/workflows/cleanup-releases.yml

@@ -8,7 +8,7 @@ jobs:
   cleanup:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@v8
+      - uses: actions/github-script@v9
         with:
           script: |
             // Get all releases with pagination, sorted by creation date (newest first)

.github/workflows/deploy.yml

@@ -17,10 +17,10 @@ jobs:
     name: Build Docusaurus
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 20.x
           cache: npm
@@ -31,7 +31,7 @@ jobs:
         run: npm run build
 
       - name: Upload Build Artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
         with:
           path: docs/build/tableau-mcp
 
@@ -53,4 +53,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

.github/workflows/docker-publish.yml

@@ -17,31 +17,52 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+
+      - name: Preflight — release tag must match package.json version
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        # The `latest` guard below keys off the release TAG NAME while the npm
+        # side (publish.yml) keys off package.json — this preflight (same check
+        # in both workflows) makes a mismatch fail loudly instead of letting the
+        # two registries disagree about moving `latest`.
+        run: |
+          VERSION="$(node -p "require('./package.json').version")"
+          if [[ -z "$VERSION" || "$VERSION" == "undefined" ]]; then
+            echo "::error::Could not read version from package.json — aborting"
+            exit 1
+          fi
+          if [[ "$RELEASE_TAG" != "v$VERSION" ]]; then
+            echo "::error::Release tag '$RELEASE_TAG' != 'v$VERSION' (package.json) — aborting. Tag the exact commit whose package.json matches, or fix the release tag."
+            exit 1
+          fi
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract metadata (tags, labels)
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
             type=semver,pattern={{major}}
-            type=raw,value=latest,enable=${{ github.event_name == 'release' }}
+            # Move `latest` only for STABLE releases — a prerelease/hotfix tag
+            # (one containing a `-`, e.g. v2.18.0-hotfix.1) gets its exact-version
+            # Docker tag but must NOT steal `latest`, mirroring the npm publish guard.
+            type=raw,value=latest,enable=${{ github.event_name == 'release' && !contains(github.event.release.tag_name, '-') }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           push: true

.github/workflows/pr-feature-label.yml

@@ -0,0 +1,56 @@
+name: PR Feature Label
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+jobs:
+  label:
+    runs-on: ubuntu-latest
+    # Skip fork PRs (read-only token can't label) and dependabot — matches repo convention
+    if: github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]'
+    permissions:
+      issues: write # create the label if it doesn't exist yet
+      pull-requests: write # add the label to the PR
+    steps:
+      - uses: actions/github-script@v8
+        with:
+          script: |
+            const prefix = 'feature/';
+            const pr = context.payload.pull_request;
+
+            // Label whichever side of the PR is a feature branch:
+            //  - base is feature/* : a PR merging INTO a long-lived feature branch
+            //  - head is feature/* : a feature branch being merged into main (or elsewhere)
+            // Both produce a "feature:<name>" label; if both sides qualify, both are applied.
+            const labels = [...new Set(
+              [pr.base.ref, pr.head.ref]
+                .filter((ref) => ref.startsWith(prefix))
+                .map((ref) => `feature:${ref.slice(prefix.length)}`)
+            )];
+
+            if (labels.length === 0) {
+              console.log(`Neither base "${pr.base.ref}" nor head "${pr.head.ref}" is a feature branch; nothing to do.`);
+              return;
+            }
+
+            // Create any labels that don't exist yet (auto-created gray).
+            for (const label of labels) {
+              try {
+                await github.rest.issues.getLabel({ ...context.repo, name: label });
+              } catch (error) {
+                if (error.status === 404) {
+                  await github.rest.issues.createLabel({ ...context.repo, name: label, color: 'ededed' });
+                  console.log(`Created label "${label}"`);
+                } else {
+                  throw error;
+                }
+              }
+            }
+
+            await github.rest.issues.addLabels({
+              ...context.repo,
+              issue_number: pr.number,
+              labels,
+            });
+            console.log(`Applied label(s) ${labels.map((l) => `"${l}"`).join(', ')} to PR #${pr.number}`);

.github/workflows/pr-post-merge-tests.yml

@@ -10,10 +10,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Use Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '>=22.7.5 <23'
           cache: 'npm'

.github/workflows/pr-title-check.yml

@@ -4,19 +4,58 @@ on:
   pull_request:
     branches:
       - main
-    types: [opened, edited, synchronize, reopened]
+    types: [opened, edited, synchronize, reopened, labeled, unlabeled]
 
 jobs:
   check-title:
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
     steps:
-      - name: Check PR title format
+      - name: Ensure skip-title-check label exists
         if: github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const name = 'skip-title-check';
+            try {
+              await github.rest.issues.getLabel({ ...context.repo, name });
+            } catch (error) {
+              if (error.status === 404) {
+                try {
+                  await github.rest.issues.createLabel({
+                    ...context.repo,
+                    name,
+                    color: 'ededed',
+                    description: 'Bypass the PR title @W- work item check',
+                  });
+                } catch (createError) {
+                  // 422 = already exists (e.g., concurrent workflow run)
+                  if (createError.status !== 422) {
+                    throw createError;
+                  }
+                }
+              } else {
+                throw error;
+              }
+            }
+
+      - name: Check PR title format
+        if: >-
+          github.event.pull_request.head.repo.full_name == github.repository &&
+          github.actor != 'dependabot[bot]' &&
+          !contains(github.event.pull_request.labels.*.name, 'skip-title-check')
         env:
           PR_TITLE: ${{ github.event.pull_request.title }}
         run: |
+          if [[ "${PR_TITLE,,}" =~ ^docs: ]]; then
+            echo "✅ Docs PR - skipping work item number check"
+            exit 0
+          fi
+
           if [[ ! "$PR_TITLE" =~ ^@W-[0-9]+ ]]; then
             echo "❌ PR title must match the pattern '@W-<digits>' (e.g., @W-123456)"
+            echo "   To bypass: prefix the title with 'docs:' or add the 'skip-title-check' label."
             exit 1
           fi
 

.github/workflows/publish.yml

@@ -9,25 +9,69 @@ jobs:
       contents: read
       id-token: write # Needed for OIDC authentication
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: '>=22.7.5'
           registry-url: https://registry.npmjs.org/
-      - run: |
+      - env:
+          # Passed via env (not inline ${{ }} in the script) — the tag name is
+          # release-author-controlled input; env keeps it out of shell parsing.
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
           git fetch --tags
-          git checkout -b publish ${{ github.event.release.tag_name }}
+          git checkout -b publish "$RELEASE_TAG"
           npm install -g npm@latest
           npm ci
           npm run build
-          npm publish
+          # Build the desktop variant into the same build/ dir. --dirty preserves the
+          # default build/index.js emitted above (a non-dirty desktop build would wipe it).
+          npx tsx src/scripts/build.ts --variant desktop --dirty
+          # Fail the publish if either entry point or the staged desktop data is missing.
+          test -f build/index.js
+          test -f build/index.desktop.js
+          test -d build/desktop/data
+          # Prerelease-aware publish. A SemVer prerelease version (one containing a
+          # `-`, e.g. 2.18.0-hotfix.1; build metadata `+...` is NOT a prerelease)
+          # must NOT reassign the `latest` npm dist-tag — otherwise a hotfix off an
+          # old release line would steal `latest` from the real release line. npm
+          # moves `latest` on EVERY bare `npm publish`, so prereleases publish
+          # under a dedicated dist-tag instead.
+          # NOTE: the dist-tag must NOT itself be a valid SemVer version (npm
+          # rejects that), so we use `hotfix-v<version>` rather than the bare
+          # version. Consumers pin the exact version (`@2.18.0-hotfix.1`)
+          # regardless; the dist-tag is just a non-`latest` pointer.
+          # Fail CLOSED: if the version can't be read, abort before publishing —
+          # a bare publish on an empty version would wrongly move `latest`.
+          # VERSION comes from package.json (the repo's own committed value, not
+          # external input) into a shell var — no GitHub expression interpolation here.
+          VERSION="$(node -p "require('./package.json').version")"
+          if [[ -z "$VERSION" || "$VERSION" == "undefined" ]]; then
+            echo "::error::Could not read version from package.json — aborting publish (refusing to risk moving 'latest')"
+            exit 1
+          fi
+          # PREFLIGHT: the release tag must be exactly v<package.json version>.
+          # npm decides prerelease-vs-stable from package.json while Docker
+          # (docker-publish.yml) decides from the release tag name — a mismatch
+          # would let the two registries disagree about moving `latest`.
+          if [[ "$RELEASE_TAG" != "v$VERSION" ]]; then
+            echo "::error::Release tag '$RELEASE_TAG' != 'v$VERSION' (package.json) — aborting. Tag the exact commit whose package.json matches, or fix the release tag."
+            exit 1
+          fi
+          if [[ "$VERSION" == *-* ]]; then
+            echo "Prerelease $VERSION -> npm publish --tag hotfix-v$VERSION (NOT moving 'latest')"
+            npm publish --tag "hotfix-v$VERSION"
+          else
+            echo "Stable $VERSION -> npm publish (moves 'latest')"
+            npm publish
+          fi
   upload-mcpb:
     runs-on: ubuntu-latest
     permissions:
       contents: write # Needed to upload release assets
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: '>=22.7.5'
           cache: 'npm'

.github/workflows/tag.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
 
       - name: Create tag
         id: tag

.github/workflows/test-deploy.yml

@@ -17,10 +17,10 @@ jobs:
     name: Test deployment
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 20.x
           cache: npm
@@ -30,7 +30,7 @@ jobs:
       - name: Test build website
         run: npm run build
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: artifacts
           if-no-files-found: error