@agentage/cli 0.45.0 → 0.47.0

package/README.md

@@ -189,6 +189,8 @@ Releases publish to npm via GitHub Actions when a `chore(release): X.Y.Z` commit
 `package.json` lands on `master` (the squash-merge subject of a release PR). The workflow skips
 any version already on npm.
 
+An extension release (`agentage extension release`) skips npm for a package with `"private": true`: it pushes the images, attaches the record and prints `PASS npm: private package, not published`.
+
 ## License
 
 MIT - see [LICENSE](./LICENSE).

package/dist/commands/extension/create.js

@@ -76,13 +76,28 @@ const renameLock = (dir, id) => {
             Object.assign(at, { name });
     save(join(dir, LOCK), lock);
 };
+// Bounded, a partial folder removed; git's own first line says why (no repo, no network, no access).
 const clone = async (url, from, dir) => {
     const env = { ...process.env, GIT_TERMINAL_PROMPT: '0' };
-    await run('git', ['clone', '-q', '--depth', '1', url, dir], { env }).catch(() => {
-        throw new Error(`template ${from} not found`);
+    await run('git', ['clone', '-q', '--depth', '1', url, dir], { env, timeout: 120_000 }).catch((err) => {
+        rmSync(dir, { recursive: true, force: true });
+        const why = (err.stderr?.trim() || err.message).split('\n')[0];
+        throw new Error(`cannot clone template ${from}: ${why}`);
     });
     rmSync(join(dir, '.git'), { recursive: true, force: true });
 };
+// A half-made folder is removed, so a re-run is not refused as "exists".
+const shape = (dir, from, id, kept) => {
+    try {
+        drop(dir, kept);
+        rewrite(dir, id);
+        renameLock(dir, id);
+    }
+    catch (err) {
+        rmSync(dir, { recursive: true, force: true });
+        throw new Error(`template ${from}: ${err.message}`);
+    }
+};
 // Clones the template's default branch into ./extension-<id> as a new working copy, no history.
 export const runExtensionCreate = async (opts, url = (from) => `https://github.com/${from}`) => {
     const { id, from = TEMPLATE } = opts;
@@ -92,9 +107,7 @@ export const runExtensionCreate = async (opts, url = (from) => `https://github.c
         throw new Error(refused);
     const dir = `extension-${id}`;
     await clone(url(from), from, dir);
-    drop(dir, kept);
-    rewrite(dir, id);
-    renameLock(dir, id);
+    shape(dir, from, id, kept);
     const kit = String(json(join(dir, 'package.json'))['dependencies']?.['@agentage/extension'] ?? '?');
     console.log(` template  ${from} (default branch, kit ${kit.replace(/^[\^~]/, '')})`);
     console.log(` kept      ${kept.join(', ')}`);

package/dist/commands/extension/release.js

@@ -39,17 +39,35 @@ const tokenConfig = async (token) => {
     await writeFile(file, '//registry.npmjs.org/:_authToken=${NPM_TOKEN}\n');
     return ['--userconfig', file];
 };
+// Only E404 means "not on npm"; a registry that cannot answer stops the release, never publishes.
+const onNpm = async (run, args, what) => {
+    const viewed = await run('npm', ['view', ...args]);
+    if (viewed.ok)
+        return viewed.out.trim() !== '';
+    if (!/E404/.test(viewed.err))
+        fail(`npm: cannot tell whether ${what} is on npm: ${viewed.err}`);
+    return false;
+};
+// The upload with provenance signs first: its own bound, longer than the checks.
+const PUBLISH_SECONDS = 300;
+// A killed publish may have landed: stop, never stage it again; a re-run reads "already on npm".
+const direct = async (push, spec, flags) => {
+    const published = await push('npm', ['publish', ...flags]);
+    if (/timed out after/.test(published.err))
+        fail(`npm: publish of ${spec} ${published.err}; re-run the release: it reads "already on npm" if the upload landed`);
+    return published.ok;
+};
 // OIDC trusted publishing; a new name (NPM_TOKEN set) or an unauthorized direct publish is staged.
-const publish = async (run, { name, version }, token) => {
+const publish = async (run, push, { name, version }, token) => {
     const cfg = await tokenConfig(token);
     const spec = `${name}@${version}`;
-    if ((await run('npm', ['view', spec, 'version', ...cfg])).out.trim())
+    if (await onNpm(run, [spec, 'version', ...cfg], spec))
         return step(`npm: ${spec} is already on npm`);
     const flags = ['--access', 'public', '--provenance', '--ignore-scripts', ...cfg];
-    const fresh = token !== undefined && !(await run('npm', ['view', name, 'name', ...cfg])).ok;
-    if (!fresh && (await run('npm', ['publish', ...flags])).ok)
+    const fresh = token !== undefined && !(await onNpm(run, [name, 'name', ...cfg], name));
+    if (!fresh && (await direct(push, spec, flags)))
         return step(`npm: ${spec} published`);
-    const staged = await run('npm', ['stage', 'publish', ...flags]);
+    const staged = await push('npm', ['stage', 'publish', ...flags]);
     if (!staged.ok)
         fail(`npm: ${staged.err}`);
     const why = fresh
@@ -64,7 +82,7 @@ const npmVersion = async (run) => {
         fail(`npm: npm ${v} cannot publish with OIDC: needs npm >= 11.5.1`);
     step(`npm: npm ${v}`);
 };
-const preflight = async (run, pkg, tag, sha) => {
+const preflight = async (run, pkg, tag, sha, isPrivate) => {
     if (pkg.agentage.id === 'template')
         fail('id: this repo is the starting point for extensions: create one, release that');
     step(`id: ${pkg.agentage.id} is not the template`);
@@ -76,7 +94,8 @@ const preflight = async (run, pkg, tag, sha) => {
     if (tag !== v)
         fail(`tag: ${tag} is not ${v}, the package.json version; tag the commit that sets it`);
     step(`tag: ${tag} is the package.json version`);
-    await npmVersion(run);
+    if (!isPrivate)
+        await npmVersion(run);
 };
 // One line per step, PASS or FAIL; any refusal exits 1 before anything is pushed or published.
 export const runExtensionRelease = async ({ dir = '.', timeout = 60 } = {}, deps = defaultDeps) => {
@@ -86,25 +105,29 @@ export const runExtensionRelease = async ({ dir = '.', timeout = 60 } = {}, deps
         return fail(`inputs: ${missing} is not set; run it on a tag push`);
     const secrets = takeSecrets(deps.env);
     const pkg = await (await deps.tool()).readManifest(dir);
-    const run = scoped(deps.exec(dir), secrets);
-    await preflight(run, pkg, tag, sha);
+    const run = scoped(deps.exec(dir, timeout), secrets);
+    const isPrivate = pkg['private'] === true;
+    await preflight(run, pkg, tag, sha, isPrivate);
     const { id } = pkg.agentage;
     const g = { dir, tag, sha, repo, id, version: pkg.version, parts: imageParts(pkg) };
-    const bounded = scoped(deps.exec(dir, timeout), secrets);
-    const decision = await releaseGuard(g, bounded).catch((e) => fail(`guard: ${e.message}`));
+    const decision = await releaseGuard(g, run).catch((e) => fail(`guard: ${e.message}`));
     const build = decision === 'build';
-    step(`guard: ${tag} ${build ? 'has no record and no image: build' : 'is released: npm only'}`);
+    const done = isPrivate ? 'is released' : 'is released: npm only';
+    step(`guard: ${tag} ${build ? 'has no record and no image: build' : done}`);
     if (build) {
         await runExtensionBuild({ push: true, dir }, deps.tool);
         await attach(run, tag, repo);
     }
-    await publish(run, pkg, secrets['npm']?.['NPM_TOKEN']);
+    if (isPrivate)
+        return step('npm: private package, not published');
+    const push = scoped(deps.exec(dir, PUBLISH_SECONDS), secrets);
+    await publish(run, push, pkg, secrets['npm']?.['NPM_TOKEN']);
 };
 export const addRelease = (group, release) => {
     group
         .command('release')
         .description('Release an extension from its v* tag in CI: guard, images, record, npm package')
         .option('--dir <path>', 'the extension package folder (default: the current folder)')
-        .option('--timeout <seconds>', 'bound on each GitHub and registry check (default: 60)', Number)
+        .option('--timeout <seconds>', 'bound on each git, GitHub and npm check (default: 60; npm publish: 300)', Number)
         .action(release);
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentage/cli",
-  "version": "0.45.0",
+  "version": "0.47.0",
   "description": "The agentage CLI - connect this machine to agentage from the terminal",
   "type": "module",
   "main": "./dist/index.js",
@@ -55,7 +55,7 @@
     "prepublishOnly": "npm run verify"
   },
   "dependencies": {
-    "@agentage/extension": "^0.5.1",
+    "@agentage/extension": "^0.6.0",
     "chalk": "^6.0.0",
     "commander": "^15.0.0",
     "open": "^11.0.0"