* fix(release): add repository field for npm provenance
The publish-npm step in release run 25350606233 (v0.39.1) failed for all
6 packages with:
npm error code E422
npm error 422 Unprocessable Entity
Error verifying sigstore provenance bundle: Failed to validate
repository information: package.json: "repository.url" is "",
expected to match "https://github.com/kdlbs/kandev" from provenance
We added `--provenance` to `npm publish` earlier so the registry attaches
a sigstore attestation linking each tarball to its source repo + workflow
run. The attestation is signed using info from the OIDC token (which
includes the repo). At publish time, npm cross-checks the package.json's
`repository.url` against the OIDC repo claim — if the package.json
doesn't have one, or it doesn't match, the publish is rejected.
Both the runtime template (package-npm-runtime.sh) and the main
apps/cli/package.json were missing `repository`. Adding `repository` +
`homepage` to both. The runtime template gets it inline via the
heredoc; the main package.json gets static fields.
This fix unblocks the next release. v0.39.1 itself can't be republished
(version conflict on npm if it had landed; on GitHub release it already
exists). The next release will be v0.39.2 and will go all the way through.
Side state notes:
- v0.39.1 git tag + GitHub release exist with all 5 platform tarballs.
- Homebrew tap was updated to v0.39.1 — `brew install` works as v0.39.1.
- npm has nothing at v0.39.1 (all 6 publishes 422'd).
- v0.39.2 will replace the npm side; Homebrew formula will move forward;
v0.39.1 GitHub release stays as a historical artifact.
* fix(release): re-chmod cli.js after artifact download (lost in zip roundtrip)
`brew install kdlbs/kandev/kandev` followed by `kandev` failed with:
/opt/homebrew/bin/kandev: line 2:
/opt/homebrew/Cellar/kandev/0.39.1/libexec/cli/bin/cli.js: Permission denied
cannot execute: Undefined error: 0
Inspected the published v0.39.1 macos-arm64 tarball:
-rwxr-xr-x kandev/bin/kandev (755 — executable, correct)
-rwxr-xr-x kandev/bin/agentctl (755 — executable, correct)
-rw-r--r-- kandev/cli/bin/cli.js (644 — NOT executable)
Root cause: `actions/upload-artifact@v4` + `actions/download-artifact@v4`
zip-encode the artifact during upload and extract during download.
**Executable bits do not survive that round-trip.** The Go binaries
(kandev, agentctl) keep their +x because they're built inside the same
build-bundles job (no artifact crossing); cli.js is built in build-cli,
uploaded as an artifact, downloaded in build-bundles, and emerges as 644.
The chmod +x in package-cli.sh runs before upload, so it's effectively
erased.
Fix: re-apply chmod +x to dist/kandev/cli/bin/cli.js right before
tarballing, in the Package bundle step (which runs in build-bundles
after the artifact download).
Could not have been caught by the Tier 1.1 local smoke test we did
before merging — that test cp -R'd the cli/ dir directly without an
artifact roundtrip, so the chmod survived. This bug only manifests in
CI's matrix builds.
Manual recovery for v0.39.1 brew users:
chmod +x /opt/homebrew/Cellar/kandev/0.39.1/libexec/cli/bin/cli.js
Or wait for v0.39.2 and `brew upgrade kandev`.
José Almeida
e8780d54bb