@a2f0/agent-tool 0.1.1 → 0.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +225 -189
  2. package/package.json +2 -1
package/README.md CHANGED
@@ -1,46 +1,20 @@
1
1
  # agent-tool
2
2
 
3
- A standalone CLI for independent agent reviews, GitHub PR operations, package
4
- version helpers, and portable skills for Claude Code, Codex, and OpenCode.
5
- Extracted from the agent tooling in the projects under `~/github`.
3
+ A CLI for independent agent code reviews, guarded GitHub PR operations, package
4
+ version management, and portable skills for Claude Code, Codex, and OpenCode.
6
5
 
7
- The first implementation retains TypeScript and the existing regression suite.
8
- Bun compiles the code and skill text into one executable, so installed users do
9
- not need Node, Bun, TypeScript, or repository-local npm dependencies. The current
10
- macOS ARM64 executable is approximately 58 MiB because it includes its runtime.
11
- Rust remains a reasonable later implementation choice; it is not required for
12
- Brew or Debian packaging. See [the design](docs/design.md) and
13
- [extraction record](docs/extraction.md).
6
+ - **Review** a committed branch with a different agent than the one that wrote
7
+ it, using a pinned, read-only snapshot.
8
+ - **Ship** pull requests: open them, check CI, and squash-merge only the exact
9
+ reviewed commit.
10
+ - **Version** packages: bump changed packages against an exact base and keep
11
+ `bun.lock` in sync.
12
+ - **Share skills**: install the same workflow instructions where each harness
13
+ discovers them, and check them in CI.
14
14
 
15
- ## Try it
15
+ ## Install
16
16
 
17
- Development and CI use Bun 1.4.2. The source CLI runs on Bun 1.3.11 or newer,
18
- but `versions prepare` needs Bun 1.4 or newer on PATH to refresh workspace
19
- versions in `bun.lock`. Runtime requires Git; GitHub commands also require
20
- authenticated `gh`. Review requires an authenticated CLI for the chosen agent.
21
-
22
- ```sh
23
- bun install --frozen-lockfile
24
- bun run build
25
- ./dist/agent-tool --help
26
- ./dist/agent-tool doctor
27
-
28
- # Point the installed tool at an existing project:
29
- ./dist/agent-tool --repo ../some-project review codex
30
- # Review against an explicit local base without GitHub:
31
- ./dist/agent-tool --repo ../some-project review opencode high --base main
32
-
33
- # Preview shared skills, then install them when ready:
34
- ./dist/agent-tool --repo ../some-project skills install
35
- ./dist/agent-tool --repo ../some-project skills install --apply
36
- ```
37
-
38
- The same binary works when copied outside this repository. No sibling project
39
- has to retain `packages/agent-tool` once its callers are migrated.
40
-
41
- ### Use as a package dependency
42
-
43
- Projects can install the source CLI from npm as `@a2f0/agent-tool`:
17
+ ### From npm
44
18
 
45
19
  ```sh
46
20
  bun add --dev --exact @a2f0/agent-tool
@@ -48,18 +22,17 @@ bun add --dev --exact @a2f0/agent-tool
48
22
  npm install --save-dev --save-exact @a2f0/agent-tool
49
23
  ```
50
24
 
51
- Run `bun run agent-tool --help` after adding a script such as
52
- `"agent-tool": "agent-tool"`. The package exposes
53
- `node_modules/.bin/agent-tool`; invoke it directly for commands containing an
54
- empty positional argument, such as
25
+ The package ships the TypeScript source and embedded skills, with no install
26
+ scripts or build step. Bun runs the executable, so Bun must be on `PATH`
27
+ wherever it runs, including npm projects and CI; without it, the shell reports
28
+ `env: bun: No such file or directory`.
29
+
30
+ Add a script such as `"agent-tool": "agent-tool"` and run
31
+ `bun run agent-tool --help`. For a command with an empty positional argument,
32
+ invoke `node_modules/.bin/agent-tool` directly, for example
55
33
  `node_modules/.bin/agent-tool pr merge '' "$REVIEWED_SHA" "$REVIEW_BASE_REF"`.
56
- The source package includes the CLI and embedded skills and needs no dependency
57
- install scripts or compile step. The executable is TypeScript run by Bun, so Bun
58
- must be on `PATH` wherever it runs, including npm projects and CI; without it,
59
- the shell reports `env: bun: No such file or directory`. The standalone binary
60
- described above remains available for use without Bun.
61
34
 
62
- To use an unreleased commit, pin a full commit SHA from GitHub instead:
35
+ To use an unreleased commit, pin its full SHA from GitHub:
63
36
 
64
37
  ```json
65
38
  {
@@ -72,6 +45,52 @@ To use an unreleased commit, pin a full commit SHA from GitHub instead:
72
45
  npm records a GitHub dependency in `package-lock.json` as a `git+ssh` URL, but
73
46
  `npm ci` installs this public repository without SSH credentials.
74
47
 
48
+ ### Standalone executable
49
+
50
+ Bun compiles the CLI and its skills into one executable that needs no Node, Bun,
51
+ or npm dependencies at runtime:
52
+
53
+ ```sh
54
+ bun install --frozen-lockfile
55
+ bun run build
56
+ ./dist/agent-tool --help
57
+ ```
58
+
59
+ The executable works when copied anywhere. See [Releases](#releases) for
60
+ platform archives, a Homebrew formula, and Debian packages.
61
+
62
+ ### Requirements
63
+
64
+ - Git.
65
+ - An authenticated GitHub CLI (`gh`) for `pr` commands. `pr merge` needs a
66
+ `gh` whose `pr checks` supports `--json`; gh 2.45, still shipped by some
67
+ distributions, fails with `unknown flag: --json`.
68
+ - An authenticated CLI for each agent you review with: `claude`, `codex`, or
69
+ `opencode`.
70
+ - Bun 1.3.11 or newer to run the npm package.
71
+ - Bun 1.4 or newer on `PATH` for `versions prepare`, with either install,
72
+ because it refreshes workspace versions in `bun.lock`.
73
+
74
+ Run `agent-tool doctor` to report installed versions and supported review flags
75
+ without calling a model.
76
+
77
+ ## Quick start
78
+
79
+ These examples call `agent-tool` from `PATH`. With the npm package, use
80
+ `bun run agent-tool` or `node_modules/.bin/agent-tool` instead.
81
+
82
+ ```sh
83
+ # Review the current branch with an independent agent:
84
+ agent-tool review codex
85
+ # Review another checkout against a local base, without GitHub:
86
+ agent-tool --repo ../some-project review opencode high --base main
87
+
88
+ # Create project policy, then preview and install the shared skills:
89
+ agent-tool init
90
+ agent-tool skills install
91
+ agent-tool skills install --apply
92
+ ```
93
+
75
94
  ## Commands
76
95
 
77
96
  | Command | Behavior |
@@ -88,23 +107,24 @@ npm records a GitHub dependency in `package-lock.json` as a `git+ssh` URL, but
88
107
  | `init` / `config show` | Create or inspect data-only project policy |
89
108
  | `doctor` | Inspect local versions and required CLI flags without running a model |
90
109
 
91
- Effort accepts `low`, `medium`, `high`, `xhigh`, and `max`. Defaults are `xhigh`
92
- for Claude and `high` for Codex and OpenCode. Older camelCase action names remain
93
- available; run `--help` for the compatibility list. The modern merge command
94
- requires reviewed HEAD and base branch; legacy `squashMerge` also retains its
95
- manual, unguarded form.
110
+ Global options are `--repo <directory>` and `--config <file>`. Effort accepts
111
+ `low`, `medium`, `high`, `xhigh`, and `max`; the default is `xhigh` for Claude
112
+ and `high` for Codex and OpenCode. Legacy camelCase action names, listed in
113
+ `--help`, remain available. Legacy `squashMerge` also accepts a manual form
114
+ without a reviewed HEAD; prefer `pr merge`.
96
115
 
97
- A successful review exit means a complete review was returned, including a
98
- `VERDICT:` line. BLOCKER or MAJOR findings still require action. The review CLI
99
- does not repair, push, or merge; the coordinating skills orchestrate that work.
116
+ A successful review exit means a complete review was returned, ending in a
117
+ `VERDICT:` line. BLOCKER or MAJOR findings still require action. The review
118
+ command does not repair, push, or merge; the shipping skills coordinate that
119
+ work.
100
120
 
101
- ## Project configuration
121
+ ## Configuration
102
122
 
103
- Run `agent-tool init` in a project to create `agent-tool.json`. Existing policy
104
- files are never overwritten. Missing settings use defaults; misspelled keys,
105
- invalid types, and unknown schema versions fail before work begins. Global
106
- `--config <file>` or `AGENT_TOOL_CONFIG` selects an explicit policy file, useful
107
- when reviewing a feature checkout with policy supplied from a trusted source.
123
+ `agent-tool init` creates `agent-tool.json` and never overwrites an existing
124
+ file. Missing settings use defaults; misspelled keys, invalid types, and unknown
125
+ schema versions fail before any work begins. `--config <file>` or
126
+ `AGENT_TOOL_CONFIG` selects an explicit policy file, for example to review a
127
+ feature checkout with policy from a trusted source.
108
128
 
109
129
  ```json
110
130
  {
@@ -131,44 +151,51 @@ when reviewing a feature checkout with policy supplied from a trusted source.
131
151
  }
132
152
  ```
133
153
 
134
- The default title policy uses conventional commits and a 72-character limit.
135
- No commitlint binary or JavaScript config is executed. Required CI names are
136
- project settings; default policy requires reported checks, rejects unsuccessful
137
- checks, and allows intentionally skipped optional jobs. A named required check
138
- must succeed. Configure explicit required names for shipping.
139
-
140
- The OpenCode model default preserves the source projects' fallback provider; set
141
- it to a model your account supports. `opencodeVariants` overrides mappings for
142
- the supplied levels, with unspecified entries passed through unchanged. Claude
143
- and Codex use their CLI defaults unless a model is configured.
144
-
145
- Version helpers discover committed `package.json` workspaces when
146
- `versions.packages` is null, or use the configured relative package directories;
147
- `.` names the repository's root package, which then changes with any file,
148
- including files in other configured packages.
149
- They preserve deliberate major/minor releases and bump changed packages one
150
- patch past the base. `plan`, `bump`, and `check` do not regenerate lockfiles or
151
- commit changes.
152
-
153
- `versions prepare` owns the whole sequence before a review snapshot. It needs a
154
- clean worktree on an attached branch with the exact base already merged. It
155
- rewrites versions and, when `versions.lockfile` is `"bun.lock"` (the default),
156
- runs `bun install --lockfile-only --ignore-scripts`. It then verifies that
157
- `bun.lock` records every workspace version, because Bun before 1.4 exits
158
- successfully without refreshing them. Each `versions.validate` command runs
159
- without a shell against the staged result; commands resolve on PATH outside
160
- the repository. The commit uses `versions.commitMessage` and runs the project's
161
- commit hooks, and must reproduce the prepared tree. Set `versions.lockfile` to
162
- null for projects without a Bun lockfile. On success it prints a JSON receipt
163
- with `baseOid`, `startHead`, `headOid`, `committed`, `lockfileChanged`, and the
164
- rewritten `versions`. A failure before the commit restores the manifests,
165
- lockfile, and index unless HEAD or other paths changed; otherwise it preserves
166
- that state for inspection. Repeating against the same base creates no commit.
154
+ The policy is data only: no commitlint binary or JavaScript config runs.
155
+
156
+ - **`subject`**: commit and PR titles default to conventional commits with a
157
+ 72-character limit.
158
+ - **`merge`**: by default a PR must report at least one check, and every check
159
+ must succeed or be skipped. Named required checks must succeed; configure
160
+ them before shipping.
161
+ - **`review`**: Claude and Codex use their CLI defaults unless a model is set.
162
+ Set `opencodeModel` to a model your account supports. `opencodeVariants`
163
+ replaces the default effort-to-variant map (`xhigh` to `max`); an effort
164
+ level missing from the map is passed to OpenCode unchanged.
165
+
166
+ ### Versions
167
+
168
+ Version helpers use the configured package directories, or discover committed
169
+ `package.json` workspaces when `versions.packages` is null. `.` names the
170
+ repository's root package, which then counts as changed when any file changes,
171
+ including files in other configured packages. A changed package moves one patch
172
+ past the base; a deliberate major or minor bump is kept. `plan`, `bump`, and
173
+ `check` neither regenerate lockfiles nor commit.
174
+
175
+ `versions prepare` runs the whole sequence before a review snapshot:
176
+
177
+ 1. It requires a clean worktree on an attached branch with the exact base
178
+ already merged.
179
+ 2. It rewrites versions and, when `versions.lockfile` is `"bun.lock"` (the
180
+ default), runs `bun install --lockfile-only --ignore-scripts`. It then
181
+ verifies that `bun.lock` records every workspace version, because Bun before
182
+ 1.4 exits successfully without refreshing them. Set `versions.lockfile` to
183
+ null for projects without a Bun lockfile.
184
+ 3. Each `versions.validate` command runs without a shell against the staged
185
+ result. Commands resolve on `PATH` outside the repository.
186
+ 4. It commits with `versions.commitMessage`, running the project's commit hooks,
187
+ and requires the commit to reproduce the prepared tree.
188
+
189
+ On success it prints a JSON receipt with `baseOid`, `startHead`, `headOid`,
190
+ `committed`, `lockfileChanged`, and the rewritten `versions`. A failure before
191
+ the commit restores the manifests, lockfile, and index, unless HEAD or other
192
+ paths changed, in which case it leaves that state for inspection. Repeating
193
+ against the same base creates no commit.
167
194
 
168
195
  ## Portable skills
169
196
 
170
- Canonical instructions live once in `skills/`. The build embeds them, and the
171
- installer places the same bytes where each harness discovers them:
197
+ Canonical skills live in `skills/`. The build embeds them, and the installer
198
+ writes the same bytes where each harness discovers them:
172
199
 
173
200
  | Target | Project discovery directory |
174
201
  | --- | --- |
@@ -177,112 +204,121 @@ installer places the same bytes where each harness discovers them:
177
204
  | OpenCode alone | `.opencode/skills` |
178
205
  | All three | `.agents/skills` and `.claude/skills`; OpenCode discovers both |
179
206
 
180
- Discovery paths follow the official [Codex](https://learn.chatgpt.com/docs/build-skills#where-codex-loads-local-skills),
207
+ Discovery paths follow the [Codex](https://learn.chatgpt.com/docs/build-skills#where-codex-loads-local-skills),
181
208
  [Claude Code](https://code.claude.com/docs/en/skills), and
182
209
  [OpenCode](https://opencode.ai/docs/skills/) documentation. Restart the harness
183
- if new skills do not appear. OpenCode may see identical names through both
184
- compatibility paths; the installed instructions are identical.
185
-
186
- The bundle provides `cross-agent-review`, `open-pr`, `squash-merge`, `ship-pr`, and
187
- `reset`. The installer tracks ownership with `.agent-tool-skills.json`, previews
188
- changes without writing, and rejects unmanaged or locally edited files and
189
- symlink destinations. Preserve existing project-specific skills before
190
- migration rather than overwriting them. Project validation and setup commands
191
- stay in repository guidance; the shared skills make no package-manager or
192
- application-layout assumptions. The installer is project-scoped; it does not
193
- modify global harness settings, MCP configuration, or authentication.
194
-
195
- To normalize consumers, install the bundled skills and keep project validation,
196
- review-bot rules, and deployment checks in `AGENTS.md`. Put title and required CI
197
- settings in `agent-tool.json` instead of copying the shipping workflow. After a
198
- dependency update, run `agent-tool skills install --apply` and commit the updated
199
- skills with `.agent-tool-skills.json`. Run `agent-tool skills check` in hooks and
200
- CI: it fails for missing, outdated, unmanaged, or locally edited skills without
201
- writing anything. Use the same `--harness` when installing and checking a single
202
- harness. Existing unmanaged skills must be preserved or deliberately migrated
203
- before installation; there is no force-overwrite mode.
210
+ if new skills do not appear. OpenCode may list identical skills from both
211
+ paths.
212
+
213
+ The bundle provides `cross-agent-review`, `open-pr`, `squash-merge`, `ship-pr`,
214
+ and `reset`. They make no package-manager or project-layout assumptions:
215
+
216
+ - Keep validation commands, review-bot rules, and deployment checks in the
217
+ project's `AGENTS.md`.
218
+ - Keep title and required-check policy in `agent-tool.json`.
219
+
220
+ The installer is project-scoped and does not touch global harness settings, MCP
221
+ configuration, or authentication. It records ownership in
222
+ `.agent-tool-skills.json`, previews changes unless `--apply` is given, and
223
+ refuses to overwrite unmanaged files, locally edited skills, or symlinks; there
224
+ is no force mode. After updating the dependency, run
225
+ `agent-tool skills install --apply` and commit the skills with
226
+ `.agent-tool-skills.json`. Run `agent-tool skills check` in hooks and CI; it
227
+ fails for missing, outdated, unmanaged, or edited skills without writing
228
+ anything. Use the same `--harness` for install and check.
204
229
 
205
230
  ## Review guarantees and limits
206
231
 
207
- The extraction retains exact base/head snapshots, base-commit review policy,
208
- raw Git blob materialization, collision/path validation, text diffs without
209
- external drivers, snapshot cleanup, verdict gating, and one retry for incomplete
210
- successful output. Git hooks and replace objects are disabled for helper Git
211
- operations. Reviewer executables must resolve outside the project, and reviews
212
- have configurable timeouts. Modern review rejects HEAD drift before returning.
213
-
214
- Claude uses safe mode and read-only tools. Codex uses an ephemeral session,
215
- snapshot-scoped filesystem permissions, no model-command environment
216
- inheritance, disabled hosted web search, and final-message capture. OpenCode uses
217
- a neutral directory, pure mode, inline permissions denying every tool by default,
218
- and specific read-only allowances. Unknown/unsupported CLI flags fail the run;
219
- there is no fallback that silently removes those protections.
220
-
221
- These are different harness protections, not a uniform OS isolation guarantee.
222
- Claude and OpenCode rely on their tool permission implementations. The launcher
223
- still uses local authentication and a host environment; the stronger
224
- credential-stripped macOS preflight from `stealth` has not been ported. A verdict
225
- is a completion marker, not proof that a model's findings are correct.
226
-
227
- GitHub atomically enforces expected HEAD during merging, but this mutation has
228
- no atomic expected-base precondition. Skills recheck base freshness; repository
229
- protection must enforce stricter concurrent-update requirements. With
230
- `merge.requireStrictBaseFreshness`, `pr merge` refuses unless the base's
231
- effective rules include an active repository ruleset requiring strict status
232
- checks that the authenticated actor can never bypass. GitHub then rejects a
233
- head that no longer contains the latest base. Classic branch protection is not
234
- inspected. Fork reviews
235
- can resolve upstream PR bases; the PR-opening helper initially supports
236
- same-repository branches.
237
-
238
- ## Packages and verification
232
+ Reviews run against exact base and head snapshots. Review policy comes from the
233
+ base commit. Files are materialized from raw Git blobs with collision and path
234
+ validation, and diffs are text-only without external drivers. Snapshots are
235
+ cleaned up, output must end in a verdict, and an incomplete but successful run
236
+ is retried once. Helper Git operations disable hooks and replace objects.
237
+ Reviewer executables must resolve outside the project, reviews time out, and a
238
+ review is rejected if HEAD moves before it returns.
239
+
240
+ Each harness runs with its own read-only protections:
241
+
242
+ - **Claude**: safe mode and read-only tools.
243
+ - **Codex**: an ephemeral session, snapshot-scoped filesystem permissions, no
244
+ inherited environment for model commands, hosted web search disabled, and
245
+ final-message capture.
246
+ - **OpenCode**: a neutral directory, pure mode, and inline permissions that
247
+ deny every tool except specific read-only ones.
248
+
249
+ Unknown or unsupported CLI flags fail the run instead of silently dropping a
250
+ protection. These are harness-level protections, not uniform OS isolation:
251
+ Claude and OpenCode rely on their own permission implementations, and every
252
+ reviewer runs with local authentication in the host environment. A verdict
253
+ shows that a review completed, not that its findings are correct.
254
+
255
+ `pr merge` binds the squash to the reviewed HEAD through GitHub's atomic
256
+ expected-HEAD check. GitHub has no equivalent expected-base check, so the skills
257
+ recheck the base, and repository protection must enforce stricter freshness.
258
+ With `merge.requireStrictBaseFreshness`, `pr merge` refuses unless an active
259
+ repository ruleset that the authenticated actor cannot bypass requires strict
260
+ status checks on the base. Classic branch protection is not inspected. Reviews
261
+ can resolve fork PR bases; `pr open` supports same-repository branches.
262
+
263
+ ## Development
264
+
265
+ Development and the CI workflow use Bun 1.4.2.
239
266
 
240
267
  ```sh
268
+ bun install --frozen-lockfile
241
269
  bun run typecheck
242
270
  bun test
243
271
  bun scripts/smoke-package.ts
244
272
  bun run build
245
273
  bun scripts/smoke.ts dist/agent-tool
246
-
247
- # Build macOS/Linux ARM64/x64 archives and a formula with real SHA-256 values:
248
- bun scripts/release.ts a2f0/agent-tool
249
-
250
- # On Linux with dpkg-deb; substitute your release version:
251
- scripts/package-deb.sh dist/agent-tool-0.1.0-linux-x64/bin/agent-tool amd64
252
- # Install a produced Debian package:
253
- sudo apt install ./dist/agent-tool_0.1.0_amd64.deb
254
274
  ```
255
275
 
256
- Release scripts create local artifacts; they do not publish anything. Put the
257
- archives at the generated release URLs and the generated `agent-tool.rb` in a
258
- Homebrew tap to support `brew install <owner>/<tap>/agent-tool`. A downloadable
259
- `.deb` supports `apt install ./file.deb`; `apt install agent-tool` by name also
260
- requires hosting a signed APT repository and configuring that source. Neither a
261
- tap nor an APT repository is live yet. The GitHub release workflow builds and
262
- uploads CI artifacts only.
276
+ `bun run build` regenerates `src/skills/bundled.ts` from `skills/*/SKILL.md`;
277
+ commit it with skill changes. The package smoke test installs the packed npm
278
+ tarball into a temporary project. The compiled smoke test drives all three
279
+ review adapters through local stubs with Bun and Node absent from `PATH`, and
280
+ makes no model calls. CI runs these checks on Linux and macOS and builds a
281
+ Debian package on Linux.
263
282
 
264
- ### npm releases
283
+ ## Releases
265
284
 
266
- ship-pr bumps the root `package.json` patch version on every merge, and the
285
+ ### npm
286
+
287
+ `ship-pr` bumps the root `package.json` patch version on each merge, and the
267
288
  [publish workflow](.github/workflows/npm-publish.yml) publishes each version
268
- newer than npm's `latest` with
269
- [trusted publishing](https://docs.npmjs.com/trusted-publishers) and provenance.
270
- No npm token is stored. The job runs in the `npm` environment, which only
271
- `main` can deploy to, and npm's trusted publisher names that environment and
272
- `npm-publish.yml`. A deliberate major or minor bump in a PR is kept. Runs never
273
- overlap, and when merges land together only the newest pending run starts, so
274
- intermediate versions can be skipped on npm.
275
-
276
- npm adds a trusted publisher only to a package that already exists, so the
277
- first version was published by hand with `npm publish --ignore-scripts`. Until
278
- a package exists, the workflow fails with that instruction rather than
279
- attempting a publish npm would reject.
280
-
281
- Standalone builds use [Bun's executable support](https://bun.sh/docs/bundler/executables).
282
- The compiled smoke test invokes all three adapters through local stubs with Bun
283
- and Node absent from PATH; it makes no paid model calls. CI checks source tests,
284
- type checking, compiled smoke tests, and Debian packaging on Linux, plus source
285
- and compiled checks on macOS.
286
-
287
- See [the validation record](docs/validation.md) for observed results and the
288
- limits of the local tests.
289
+ newer than npm's `latest` using
290
+ [trusted publishing](https://docs.npmjs.com/trusted-publishers), with
291
+ provenance and no stored npm token. The publish job runs in the `npm`
292
+ environment, which only `main` can deploy to; npm's trusted publisher names
293
+ that environment and `npm-publish.yml`. Runs never overlap, and when merges land
294
+ together only the newest pending run starts, so intermediate versions may never
295
+ reach npm. npm adds a trusted publisher only to an existing package, so the
296
+ first version was published by hand; the workflow fails with that instruction
297
+ when the package is missing from npm.
298
+
299
+ ### Standalone archives and packages
300
+
301
+ ```sh
302
+ # macOS and Linux ARM64/x64 archives, and a Homebrew formula with SHA-256 values:
303
+ bun scripts/release.ts a2f0/agent-tool
304
+
305
+ # A Debian package (Linux with dpkg-deb); substitute the release version:
306
+ scripts/package-deb.sh dist/agent-tool-<version>-linux-x64/bin/agent-tool amd64
307
+ sudo apt install ./dist/agent-tool_<version>_amd64.deb
308
+ ```
309
+
310
+ These scripts only create local artifacts. The manually triggered
311
+ `Release artifacts` workflow runs them and uploads the archives, the formula,
312
+ and amd64 and arm64 Debian packages as workflow artifacts. To offer
313
+ `brew install <owner>/<tap>/agent-tool`, host the archives at the formula's
314
+ URLs and publish `agent-tool.rb` in a tap. `apt install agent-tool` by name also
315
+ requires a signed APT repository. Neither a tap nor an APT repository exists
316
+ yet.
317
+
318
+ ## Further reading
319
+
320
+ - [Design](docs/design.md): component boundaries and implementation choices.
321
+ - [Validation record](docs/validation.md): observed test results and their
322
+ limits.
323
+ - [Extraction record](docs/extraction.md): the projects this tool was extracted
324
+ from.
package/package.json CHANGED
@@ -1,8 +1,9 @@
1
1
  {
2
2
  "name": "@a2f0/agent-tool",
3
- "version": "0.1.1",
3
+ "version": "0.1.3",
4
4
  "type": "module",
5
5
  "description": "Portable cross-agent review, PR workflows, and shared skills",
6
+ "license": "UNLICENSED",
6
7
  "repository": {
7
8
  "type": "git",
8
9
  "url": "git+https://github.com/a2f0/agent-tool.git"