José Almeida
e8780d54bb
* fix(release): add repository field for npm provenance The publish-npm step in release run 25350606233 (v0.39.1) failed for all 6 packages with: npm error code E422 npm error 422 Unprocessable Entity Error verifying sigstore provenance bundle: Failed to validate repository information: package.json: "repository.url" is "", expected to match "https://github.com/kdlbs/kandev" from provenance We added `--provenance` to `npm publish` earlier so the registry attaches a sigstore attestation linking each tarball to its source repo + workflow run. The attestation is signed using info from the OIDC token (which includes the repo). At publish time, npm cross-checks the package.json's `repository.url` against the OIDC repo claim — if the package.json doesn't have one, or it doesn't match, the publish is rejected. Both the runtime template (package-npm-runtime.sh) and the main apps/cli/package.json were missing `repository`. Adding `repository` + `homepage` to both. The runtime template gets it inline via the heredoc; the main package.json gets static fields. This fix unblocks the next release. v0.39.1 itself can't be republished (version conflict on npm if it had landed; on GitHub release it already exists). The next release will be v0.39.2 and will go all the way through. Side state notes: - v0.39.1 git tag + GitHub release exist with all 5 platform tarballs. - Homebrew tap was updated to v0.39.1 — `brew install` works as v0.39.1. - npm has nothing at v0.39.1 (all 6 publishes 422'd). - v0.39.2 will replace the npm side; Homebrew formula will move forward; v0.39.1 GitHub release stays as a historical artifact. * fix(release): re-chmod cli.js after artifact download (lost in zip roundtrip) `brew install kdlbs/kandev/kandev` followed by `kandev` failed with: /opt/homebrew/bin/kandev: line 2: /opt/homebrew/Cellar/kandev/0.39.1/libexec/cli/bin/cli.js: Permission denied cannot execute: Undefined error: 0 Inspected the published v0.39.1 macos-arm64 tarball: -rwxr-xr-x kandev/bin/kandev (755 — executable, correct) -rwxr-xr-x kandev/bin/agentctl (755 — executable, correct) -rw-r--r-- kandev/cli/bin/cli.js (644 — NOT executable) Root cause: `actions/upload-artifact@v4` + `actions/download-artifact@v4` zip-encode the artifact during upload and extract during download. **Executable bits do not survive that round-trip.** The Go binaries (kandev, agentctl) keep their +x because they're built inside the same build-bundles job (no artifact crossing); cli.js is built in build-cli, uploaded as an artifact, downloaded in build-bundles, and emerges as 644. The chmod +x in package-cli.sh runs before upload, so it's effectively erased. Fix: re-apply chmod +x to dist/kandev/cli/bin/cli.js right before tarballing, in the Package bundle step (which runs in build-bundles after the artifact download). Could not have been caught by the Tier 1.1 local smoke test we did before merging — that test cp -R'd the cli/ dir directly without an artifact roundtrip, so the chmod survived. This bug only manifests in CI's matrix builds. Manual recovery for v0.39.1 brew users: chmod +x /opt/homebrew/Cellar/kandev/0.39.1/libexec/cli/bin/cli.js Or wait for v0.39.2 and `brew upgrade kandev`.
51 lines
1.3 KiB
JSON
51 lines
1.3 KiB
JSON
{
|
|
"name": "kandev",
|
|
"version": "0.39.1",
|
|
"private": false,
|
|
"description": "Launcher for Kandev — manage tasks, orchestrate agents, review changes, and ship value",
|
|
"license": "AGPL-3.0-only",
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "git+https://github.com/kdlbs/kandev.git"
|
|
},
|
|
"homepage": "https://github.com/kdlbs/kandev",
|
|
"type": "commonjs",
|
|
"bin": {
|
|
"kandev": "bin/cli.js"
|
|
},
|
|
"main": "dist/cli.js",
|
|
"files": [
|
|
"bin",
|
|
"dist"
|
|
],
|
|
"engines": {
|
|
"npm": ">=7"
|
|
},
|
|
"optionalDependencies": {
|
|
"@kdlbs/runtime-linux-x64": "0.0.0-bootstrap",
|
|
"@kdlbs/runtime-linux-arm64": "0.0.0-bootstrap",
|
|
"@kdlbs/runtime-darwin-x64": "0.0.0-bootstrap",
|
|
"@kdlbs/runtime-darwin-arm64": "0.0.0-bootstrap",
|
|
"@kdlbs/runtime-win32-x64": "0.0.0-bootstrap"
|
|
},
|
|
"dependencies": {
|
|
"tar": "^7.5.11",
|
|
"tree-kill": "^1.2.2"
|
|
},
|
|
"devDependencies": {
|
|
"@types/node": "^20",
|
|
"esbuild": "^0.24.0",
|
|
"tsx": "^4.15.7",
|
|
"typescript": "^5",
|
|
"vitest": "^1.6.0"
|
|
},
|
|
"scripts": {
|
|
"dev": "unset npm_config_prefix && tsx src/cli.ts",
|
|
"build": "tsc -p tsconfig.json",
|
|
"bundle": "esbuild dist/cli.js --bundle --platform=node --format=cjs --outfile=dist/cli.bundle.js",
|
|
"start": "node dist/cli.js",
|
|
"test": "vitest run",
|
|
"prepublishOnly": "pnpm build"
|
|
}
|
|
}
|