- .gitea/workflows/publish-npm.yml: npm ci + audit self-check + npm publish (NPM_PACKAGE_TOKEN secret) - package.json: files whitelist (src only), prepublishOnly gate, npm install support
- 15 siyuan-mcp-compatible tools + siyuan_discover progressive-disclosure loader - Notebook-level R/W/D/NONE permission audit matrix (SQL box lookup, global rules) - New-notebook auto-sync to config.json (default R) - env-first connection config with config.json fallback - 3 self-check suites (pure-function / integration / extension e2e)