From f371841c6b00d733597ba9118e55708c4a91589e Mon Sep 17 00:00:00 2001
From: Emil Valeev <emil.musician@gmail.com>
Date: Sat, 8 Aug 2026 20:31:29 +0700
Subject: [PATCH 1/2] Prepare bundled LSP release 0.7.17

---
 .github/neva-lsp.lock                        | 6 +++---
 .github/neva-visual-editor.lock              | 6 +++---
 .github/scripts/download-neva-lsp-release.sh | 2 +-
 README.md                                    | 8 ++++++++
 package-lock.json                            | 4 ++--
 package.json                                 | 2 +-
 6 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/.github/neva-lsp.lock b/.github/neva-lsp.lock
index 996af13..b28876e 100644
--- a/.github/neva-lsp.lock
+++ b/.github/neva-lsp.lock
@@ -1,5 +1,5 @@
 # Neva LSP is a component release, not a repository-wide Neva Tools release.
 NEVA_LSP_REPOSITORY=nevalang/neva-tools
-NEVA_LSP_VERSION=lsp/v0.1.2
-NEVA_LSP_COMMIT=13e25a716506d1111bafb6147bc38cfcbfb431b0
-NEVA_LSP_CHECKSUMS_SHA256=d012f900b766d3b93e4221401e566de31221a1fe812272f7d658c91d2c6a3316
+NEVA_LSP_VERSION=lsp/v0.1.6
+NEVA_LSP_COMMIT=977fa93a25ca31cd3c98941acd2175cb39e8f84f
+NEVA_LSP_CHECKSUMS_SHA256=d37dae7b027fcbfd12359f377eb7b5a82b4d1de53338c6bb6aba1553c8ec5e02
diff --git a/.github/neva-visual-editor.lock b/.github/neva-visual-editor.lock
index 01e281a..e9de337 100644
--- a/.github/neva-visual-editor.lock
+++ b/.github/neva-visual-editor.lock
@@ -1,6 +1,6 @@
 # The shared WebView is separately versioned from both neva-lsp and neva-view.
 NEVA_VISUAL_EDITOR_REPOSITORY=nevalang/neva-tools
-NEVA_VISUAL_EDITOR_VERSION=visual-editor/v0.1.0
-NEVA_VISUAL_EDITOR_COMMIT=ad50073998708fa143fa85f9f410f450febe5a71
+NEVA_VISUAL_EDITOR_VERSION=visual-editor/v0.1.1
+NEVA_VISUAL_EDITOR_COMMIT=18397c9cec4d4ca3a7e9f9cf92f383a983c960c5
 NEVA_VISUAL_EDITOR_ASSET=neva-visual-editor.tar.gz
-NEVA_VISUAL_EDITOR_ASSET_SHA256=6fe11619b52284cbff51ca2399da6801eeb4d7f5ae7de38e36c5c2dd4d38cfa4
+NEVA_VISUAL_EDITOR_ASSET_SHA256=a6e5a79e265981b7a919698db19bc1670c5fc68e08fc768adab18a9384f8bd0d
diff --git a/.github/scripts/download-neva-lsp-release.sh b/.github/scripts/download-neva-lsp-release.sh
index f922344..8236959 100644
--- a/.github/scripts/download-neva-lsp-release.sh
+++ b/.github/scripts/download-neva-lsp-release.sh
@@ -16,7 +16,7 @@ if [[ "$tag_commit" != "$NEVA_LSP_COMMIT" ]]; then
 fi
 
 mkdir -p "$OUT_DIR"
-gh release download "$NEVA_LSP_VERSION" --repo "$NEVA_LSP_REPOSITORY" --pattern SHA256SUMS --dir "$OUT_DIR"
+gh release download "$NEVA_LSP_VERSION" --repo "$NEVA_LSP_REPOSITORY" --pattern SHA256SUMS --pattern LSP-MANIFEST.json --dir "$OUT_DIR"
 
 if [[ "$(sha256sum "$OUT_DIR/SHA256SUMS" | awk '{ print $1 }')" != "$NEVA_LSP_CHECKSUMS_SHA256" ]]; then
   echo 'Neva LSP checksum manifest does not match the lock' >&2
diff --git a/README.md b/README.md
index 3d0fbd0..547d632 100644
--- a/README.md
+++ b/README.md
@@ -70,6 +70,14 @@ Release flow:
 
 ## Release Notes
 
+### 0.7.17
+
+- Restored bundled, checksum-verified Neva LSP binaries so the extension works
+  immediately after installation without downloading tools at runtime.
+- Updated the bundled LSP to `lsp/v0.1.6`, which includes the Neva v0.41.0
+  formatter.
+- Updated the bundled Visual Mode WebView to `visual-editor/v0.1.1`.
+
 ### 0.7.10
 
 - Updated the bundled LSP to `lsp/v0.1.2` with diagnostics for unsaved edits.
diff --git a/package-lock.json b/package-lock.json
index c91fbca..969b3a4 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "vscode-nevalang",
-  "version": "0.7.10",
+  "version": "0.7.17",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "vscode-nevalang",
-      "version": "0.7.10",
+      "version": "0.7.17",
       "license": "MIT",
       "dependencies": {
         "vscode-languageclient": "^9.0.1"
diff --git a/package.json b/package.json
index f5ebe39..8e987e0 100644
--- a/package.json
+++ b/package.json
@@ -9,7 +9,7 @@
   },
   "description": "VSCode extension for Neva programming language",
   "publisher": "nevalang",
-  "version": "0.7.10",
+  "version": "0.7.17",
   "license": "MIT",
   "engines": {
     "vscode": "^1.78.0"

From e8bfbfa054830c0e0683059843eb5ea3430c4ad3 Mon Sep 17 00:00:00 2001
From: Emil Valeev <emil.musician@gmail.com>
Date: Sun, 9 Aug 2026 00:21:09 +0700
Subject: [PATCH 2/2] Enforce SemVer release naming

---
 .github/workflows/release-marketplace.yml |  9 +-------
 README.md                                 | 10 ++++++---
 scripts/validate-release-version.sh       | 26 +++++++++++++++++++++++
 3 files changed, 34 insertions(+), 11 deletions(-)
 create mode 100755 scripts/validate-release-version.sh

diff --git a/.github/workflows/release-marketplace.yml b/.github/workflows/release-marketplace.yml
index 2070d91..3deaa8b 100644
--- a/.github/workflows/release-marketplace.yml
+++ b/.github/workflows/release-marketplace.yml
@@ -59,14 +59,7 @@ jobs:
       - name: Verify release tag matches package version
         if: github.event_name == 'release'
         shell: bash
-        run: |
-          set -euo pipefail
-          TAG="${GITHUB_REF_NAME#v}"
-          PKG_VERSION=$(node -p "require('./package.json').version")
-          if [[ "$TAG" != "$PKG_VERSION" ]]; then
-            echo "Tag version ($TAG) does not match package.json version ($PKG_VERSION)" >&2
-            exit 1
-          fi
+        run: bash scripts/validate-release-version.sh "$GITHUB_REF_NAME" "${{ github.event.release.name }}"
 
       - name: Install dependencies
         run: npm ci
diff --git a/README.md b/README.md
index 547d632..3e46481 100644
--- a/README.md
+++ b/README.md
@@ -64,9 +64,13 @@ Required secret in GitHub repository settings:
 
 Release flow:
 
-1. Bump `package.json` version (for example `0.7.8`) and commit.
-2. Create git tag `v0.7.8` and GitHub Release from that tag.
-3. Workflow validates that tag version matches `package.json`, then publishes automatically.
+1. Bump `package.json` to plain `MAJOR.MINOR.PATCH` (for example `0.7.17`) and commit.
+2. Create the git tag `v0.7.17` and GitHub Release with the exact name `v0.7.17`.
+3. Run `bash scripts/validate-release-version.sh v0.7.17 v0.7.17` locally.
+4. The workflow validates the naming contract, then publishes automatically.
+
+Release naming is intentionally strict: `vMAJOR.MINOR.PATCH` only. No
+prefixes, suffixes, prerelease labels, or build metadata.
 
 ## Release Notes
 
diff --git a/scripts/validate-release-version.sh b/scripts/validate-release-version.sh
new file mode 100755
index 0000000..2059036
--- /dev/null
+++ b/scripts/validate-release-version.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+tag="${1:?release tag is required}"
+release_name="${2:-$tag}"
+version="$(node -p "require('./package.json').version")"
+expected="v${version}"
+
+[[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || {
+  echo "package.json version must be plain SemVer MAJOR.MINOR.PATCH: $version" >&2
+  exit 1
+}
+[[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || {
+  echo "release tag must be vMAJOR.MINOR.PATCH: $tag" >&2
+  exit 1
+}
+[[ "$tag" == "$expected" ]] || {
+  echo "release tag ($tag) does not match package.json ($expected)" >&2
+  exit 1
+}
+[[ "$release_name" == "$expected" ]] || {
+  echo "release name ($release_name) must be exactly $expected" >&2
+  exit 1
+}
+
+echo "ok: release is $expected"