maintainer-preflightlisted

# Maintainer preflight (claude-grok-build-plugin) Run these before saying done. Evidence, not vibes. **A code fix also needs a Grok second opinion before done** — the adversarial pass is step 5 of "작업 수행 방법" in root `CLAUDE.md`, which owns the recipe (a review prompt that asks only for prose never terminates). Read its `verdict.md` yourself, and verify any finding by measurement before acting on it. ## Always ```bash cd mcp-server npm ci # missing OR possibly-stale node_modules — see below npm test npm run typecheck ``` Both must pass. Report the real counts from this session's run — never summarize a run you did not execute. **`npm ci` is not only for a missing `node_modules`.** A tree that is merely *stale* is worse than a missing one, because the build succeeds and silently ships the wrong dependency. Measured 2026-08-09: `node_modules` held `fast-uri` 3.1.4 while the lockfile pinned 3.1.5, and `npm run build` produced a `dist/index.js` with the v0.2.6 security patch (GHSA-7p8r-x3mc-p8w7) **removed** — a clean-looking rebuild that reverted a shipped fix. Cheap check before trusting a build: ```bash node -e "console.log(require('./node_modules/<pkg>/package.json').version)" # vs package-lock.json ``` When in doubt, just run `npm ci` — it costs seconds and removes the whole class of error. ## If you touched anything that changes the bundle That means **any** of these — not just source: - `mcp-server/src/**` - `mcp-server/package-lock.json` or `mcp-serve