Version `0.1.0` is hardcoded in five places with nothing keeping them in sync

[rajarshidattapy]

Severity: Low
Files: package.json:3, app/api/[transport]/route.ts:13, src/stdio.ts:7, mcpb/manifest.json:5, server.json:9

Description

The same version string is written independently in five files:

// package.json:3
"version": "0.1.0",

// app/api/[transport]/route.ts:11-13 — advertised to MCP clients
serverInfo: { name: "Bolna", version: "0.1.0" },

// src/stdio.ts:7 — advertised by the MCPB desktop build
const server = new McpServer({ name: "Bolna", version: "0.1.0" });

// mcpb/manifest.json:5 — extension version shown in Claude Desktop
"version": "0.1.0",

// server.json:9 — MCP registry entry
"version": "0.1.0",

Nothing derives any of these from another, and there is no release script that
would notice a mismatch — package.json has dev, build, start,
typecheck, build:mcpb-server, and package:mcpb, none of which touch
versioning.

Impact

The first release that bumps some but not all of them ships a server that
misreports its own version over the wire. That matters more than usual here
because there are two distribution channels with independent update paths — the
remote server at mcp.bolna.ai and the .mcpb desktop extension — so the two
builds can legitimately be at different versions while both claiming 0.1.0.
Debugging a client-specific problem then starts from an unreliable version
number, and the registry entry can advertise a version that is not deployed.

Suggested fix

Make package.json the single source and read from it where possible:

• route.ts and stdio.ts can import the version rather than restating it
• mcpb/manifest.json and server.json are static JSON; have package:mcpb
  (and whatever publishes the registry entry) stamp them from package.json, or
  add a typecheck-adjacent script that fails when the five values disagree

The consistency check is the smaller change and catches the failure at the point
where it matters, which is release time.