@agentrhq/webcmd 0.3.0 → 0.3.2

package/dist/src/output.test.js

@@ -1,53 +1,143 @@
-import { describe, expect, it, vi, beforeEach, afterEach } from 'vitest';
-import { render } from './output.js';
-describe('output TTY detection', () => {
-    const originalIsTTY = process.stdout.isTTY;
-    let logSpy;
-    beforeEach(() => {
-        logSpy = vi.spyOn(console, 'log').mockImplementation(() => { });
-    });
-    afterEach(() => {
-        Object.defineProperty(process.stdout, 'isTTY', { value: originalIsTTY, writable: true });
-        logSpy.mockRestore();
-    });
-    it('outputs YAML in non-TTY when format is default table', () => {
-        Object.defineProperty(process.stdout, 'isTTY', { value: false, writable: true });
-        // commanderAdapter always passes fmt:'table' as default — this must still trigger downgrade
-        render([{ name: 'alice', score: 10 }], { fmt: 'table', columns: ['name', 'score'] });
-        const out = logSpy.mock.calls.map((c) => c[0]).join('\n');
-        expect(out).toContain('name: alice');
-        expect(out).toContain('score: 10');
-    });
-    it('outputs table in TTY when format is default table', () => {
-        Object.defineProperty(process.stdout, 'isTTY', { value: true, writable: true });
-        render([{ name: 'alice', score: 10 }], { fmt: 'table', columns: ['name', 'score'] });
-        const out = logSpy.mock.calls.map((c) => c[0]).join('\n');
-        expect(out).toContain('alice');
-    });
-    it('respects explicit -f json even in non-TTY', () => {
-        Object.defineProperty(process.stdout, 'isTTY', { value: false, writable: true });
-        render([{ name: 'alice' }], { fmt: 'json' });
-        const out = logSpy.mock.calls.map((c) => c[0]).join('\n');
-        expect(JSON.parse(out)).toEqual([{ name: 'alice' }]);
-    });
-    it('shows elapsed time when elapsed is 0', () => {
-        Object.defineProperty(process.stdout, 'isTTY', { value: true, writable: true });
-        render([{ name: 'alice' }], { fmt: 'table', columns: ['name'], elapsed: 0 });
-        const out = logSpy.mock.calls.map((c) => c[0]).join('\n');
-        expect(out).toContain('0.0s');
-    });
-    it('explicit -f table overrides non-TTY auto-downgrade', () => {
-        Object.defineProperty(process.stdout, 'isTTY', { value: false, writable: true });
-        render([{ name: 'alice' }], { fmt: 'table', fmtExplicit: true, columns: ['name'] });
-        const out = logSpy.mock.calls.map((c) => c[0]).join('\n');
-        // Should be table output, not YAML
-        expect(out).not.toContain('name: alice');
-        expect(out).toContain('alice');
-    });
-    it('prints single markdown payloads without wrapping them in a table', () => {
-        render([{ markdown: '# Title\n\nBody' }], { fmt: 'md' });
-        const out = logSpy.mock.calls.map((c) => c[0]).join('\n');
-        expect(out).toBe('# Title\n\nBody');
-        expect(out).not.toContain('| markdown |');
+import { createHash } from 'node:crypto';
+import { Writable } from 'node:stream';
+import { describe, expect, it } from 'vitest';
+import { formatErrorEnvelope, formatOutput, render } from './output.js';
+function sink(isTTY) {
+    let data = '';
+    const stream = new Writable({
+        write(chunk, _encoding, callback) {
+            data += String(chunk);
+            callback();
+        },
+    });
+    Object.defineProperty(stream, 'isTTY', { value: isTTY });
+    return { stream, text: () => data };
+}
+function rendered(data, options, isTTY) {
+    const stdout = sink(isTTY);
+    render(data, { ...options, stdout: stdout.stream });
+    return stdout.text();
+}
+describe('formatOutput', () => {
+    it.each([
+        { name: 'null', data: null, options: { fmt: 'json', fmtExplicit: true }, isTTY: false },
+        { name: 'empty arrays', data: [], options: { fmt: 'table', fmtExplicit: true }, isTTY: true },
+        { name: 'one scalar field', data: { value: 'hello' }, options: { fmt: 'plain', fmtExplicit: true }, isTTY: false },
+        {
+            name: 'multiple rows',
+            data: [{ name: 'alice', score: 10 }, { name: 'bob', score: 20 }],
+            options: { fmt: 'table', fmtExplicit: true, columns: ['name', 'score'] },
+            isTTY: true,
+        },
+    ])('renders $name byte-identically through the pure and stream APIs', ({ data, options, isTTY }) => {
+        expect(rendered(data, options, isTTY)).toBe(formatOutput(data, { ...options, isTTY }));
+    });
+    it('escapes commas, quotes, and newlines in CSV', () => {
+        expect(formatOutput([
+            { name: 'a,b', note: 'said "hello"' },
+            { name: 'plain', note: 'line 1\nline 2' },
+        ], { fmt: 'csv', fmtExplicit: true, columns: ['name', 'note'], isTTY: false })).toBe('name,note\n"a,b","said ""hello"""\nplain,"line 1\nline 2"\n');
+    });
+    it('preserves the legacy literal Markdown table cells', () => {
+        expect(formatOutput([
+            { name: 'a|b', note: 'line 1\nline 2' },
+        ], { fmt: 'md', fmtExplicit: true, columns: ['name', 'note'], isTTY: false })).toBe('| name | note |\n| --- | --- |\n| a|b | line 1\nline 2 |\n');
+    });
+    it('uses YAML for an implicit table format on a non-TTY stream', () => {
+        expect(rendered([{ name: 'alice', score: 10 }], {
+            fmt: 'table',
+            fmtExplicit: false,
+            columns: ['name', 'score'],
+        }, false)).toBe('- name: alice\n  score: 10\n\n');
+    });
+    it('uses a table for an implicit table format on a TTY stream', () => {
+        const output = rendered([{ name: 'alice', score: 10 }], {
+            fmt: 'table',
+            fmtExplicit: false,
+            columns: ['name', 'score'],
+        }, true);
+        expect(output).toContain('alice');
+        expect(output).toContain('1 items');
+        expect(output).not.toContain('name: alice');
+    });
+    it('honors an explicit table format on a non-TTY stream', () => {
+        const output = rendered([{ name: 'alice' }], {
+            fmt: 'table',
+            fmtExplicit: true,
+            columns: ['name'],
+        }, false);
+        expect(output).toContain('alice');
+        expect(output).not.toContain('name: alice');
+    });
+    it('honors an explicit JSON format on a non-TTY stream', () => {
+        expect(rendered([{ name: 'alice' }], {
+            fmt: 'json',
+            fmtExplicit: true,
+        }, false)).toBe('[\n  {\n    "name": "alice"\n  }\n]\n');
+    });
+    it('writes values larger than 1 MiB completely', () => {
+        const value = 'x'.repeat((1024 * 1024) + 17);
+        const expected = `${value}\n`;
+        const output = rendered({ value }, { fmt: 'plain', fmtExplicit: true }, false);
+        expect(output.length).toBe(expected.length);
+        expect(createHash('sha256').update(output).digest('hex'))
+            .toBe(createHash('sha256').update(expected).digest('hex'));
+    });
+    it('does not resolve stream rendering before the write callback and drain', async () => {
+        let release;
+        const stdout = new Writable({
+            highWaterMark: 1,
+            write(_chunk, _encoding, callback) {
+                release = callback;
+            },
+        });
+        let settled = false;
+        const rendering = render({ value: 'slow' }, {
+            fmt: 'plain',
+            fmtExplicit: true,
+            stdout,
+        }).then(() => { settled = true; });
+        await new Promise(resolve => setImmediate(resolve));
+        expect(settled).toBe(false);
+        release?.();
+        await rendering;
+        expect(settled).toBe(true);
+    });
+    it('shows elapsed time when elapsed is zero', () => {
+        expect(formatOutput([{ name: 'alice' }], {
+            fmt: 'table',
+            fmtExplicit: true,
+            columns: ['name'],
+            elapsed: 0,
+            isTTY: true,
+        })).toContain('0.0s');
+    });
+    it('prints single Markdown payloads without wrapping them in a table', () => {
+        expect(formatOutput([{ markdown: '# Title\n\nBody' }], {
+            fmt: 'md',
+            fmtExplicit: true,
+            isTTY: false,
+        })).toBe('# Title\n\nBody\n');
+    });
+});
+describe('formatErrorEnvelope', () => {
+    it('returns the local YAML envelope bytes without writing to stderr', () => {
+        expect(formatErrorEnvelope({
+            ok: false,
+            error: {
+                code: 'AUTH_REQUIRED',
+                message: 'Sign in first',
+                help: 'Run webcmd github login.',
+                exitCode: 77,
+            },
+        })).toBe([
+            'ok: false',
+            'error:',
+            '  code: AUTH_REQUIRED',
+            '  message: Sign in first',
+            '  help: Run webcmd github login.',
+            '  exitCode: 77',
+            '',
+        ].join('\n'));
     });
 });

package/dist/src/pipeline/executor.test.js

@@ -18,6 +18,7 @@ function createMockPage(overrides = {}) {
         pressKey: vi.fn(),
         getFormState: vi.fn().mockResolvedValue({}),
         wait: vi.fn(),
+        sleep: vi.fn().mockResolvedValue(undefined),
         tabs: vi.fn().mockResolvedValue([]),
         selectTab: vi.fn(),
         networkRequests: vi.fn().mockResolvedValue([]),

package/dist/src/pipeline/steps/download.test.js

@@ -30,6 +30,7 @@ function createMockPage(getCookies) {
         scrollTo: vi.fn(),
         getFormState: vi.fn().mockResolvedValue({}),
         wait: vi.fn(),
+        sleep: vi.fn().mockResolvedValue(undefined),
         tabs: vi.fn().mockResolvedValue([]),
         selectTab: vi.fn(),
         networkRequests: vi.fn().mockResolvedValue([]),

package/dist/src/plugin-create-cli.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/plugin-create-cli.test.js

@@ -0,0 +1,37 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { createProgram } from './cli.js';
+describe('webcmd plugin create', () => {
+    const createdDirs = [];
+    afterEach(() => {
+        for (const dir of createdDirs)
+            fs.rmSync(dir, { recursive: true, force: true });
+        vi.restoreAllMocks();
+        process.exitCode = undefined;
+    });
+    it('writes author name and GitHub handle supplied as flags', async () => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'webcmd-plugin-create-'));
+        fs.rmSync(dir, { recursive: true, force: true });
+        createdDirs.push(dir);
+        vi.spyOn(console, 'log').mockImplementation(() => { });
+        const program = createProgram('', '');
+        program.exitOverride();
+        await program.parseAsync([
+            'node',
+            'webcmd',
+            'plugin',
+            'create',
+            'weather',
+            '--dir',
+            dir,
+            '--author-name',
+            'Rishabh',
+            '--author-handle',
+            'rishabhraj36',
+        ]);
+        const manifest = JSON.parse(fs.readFileSync(path.join(dir, 'webcmd-plugin.json'), 'utf-8'));
+        expect(manifest.author).toEqual({ name: 'Rishabh', handle: 'rishabhraj36' });
+    });
+});

package/dist/src/plugin-manifest.d.ts

@@ -5,6 +5,12 @@
  * 1. Single plugin: repo root IS the plugin directory.
  * 2. Monorepo: repo contains multiple plugins declared in `plugins` field.
  */
+export interface PluginAuthor {
+    /** Display name shown in generated catalogs. */
+    name: string;
+    /** GitHub username used to link the author profile. */
+    handle: string;
+}
 export interface SubPluginEntry {
     /** Relative path from repo root to the sub-plugin directory. */
     path: string;
@@ -14,6 +20,8 @@ export interface SubPluginEntry {
     webcmd?: string;
     /** When true, this sub-plugin is skipped during install. */
     disabled?: boolean;
+    /** Plugin author attribution. */
+    author?: PluginAuthor;
 }
 export interface PluginManifest {
     /** Plugin name (single-plugin mode). */
@@ -24,10 +32,14 @@ export interface PluginManifest {
     webcmd?: string;
     /** Human-readable description. */
     description?: string;
+    /** Plugin author attribution. */
+    author?: PluginAuthor;
     /** Monorepo sub-plugins. Key = logical plugin name. */
     plugins?: Record<string, SubPluginEntry>;
 }
 export declare const MANIFEST_FILENAME = "webcmd-plugin.json";
+/** Validate explicit plugin author metadata without making a GitHub API call. */
+export declare function validatePluginAuthor(value: unknown, label?: string): PluginAuthor;
 /**
  * Read and parse webcmd-plugin.json from a directory.
  * Returns null if the file does not exist or is unparseable.

package/dist/src/plugin-manifest.js

@@ -9,7 +9,23 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { PKG_VERSION } from './version.js';
 export const MANIFEST_FILENAME = 'webcmd-plugin.json';
+const GITHUB_HANDLE_PATTERN = /^[a-z\d](?:[a-z\d]|-(?=[a-z\d])){0,38}$/i;
 // ── Read / Validate ─────────────────────────────────────────────────────────
+/** Validate explicit plugin author metadata without making a GitHub API call. */
+export function validatePluginAuthor(value, label = 'author') {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new Error(`Invalid ${label}: expected an object`);
+    }
+    const author = value;
+    const name = typeof author.name === 'string' ? author.name.trim() : '';
+    if (!name)
+        throw new Error(`Invalid ${label}.name: expected a non-empty string`);
+    const handle = typeof author.handle === 'string' ? author.handle.trim() : '';
+    if (!GITHUB_HANDLE_PATTERN.test(handle)) {
+        throw new Error(`Invalid ${label}.handle: expected a valid GitHub username`);
+    }
+    return { name, handle };
+}
 /**
  * Read and parse webcmd-plugin.json from a directory.
  * Returns null if the file does not exist or is unparseable.

package/dist/src/plugin-manifest.test.js

@@ -5,7 +5,25 @@ import { describe, it, expect, beforeEach, afterEach } from 'vitest';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as os from 'node:os';
-import { _readPluginManifest as readPluginManifest, _isMonorepo as isMonorepo, _getEnabledPlugins as getEnabledPlugins, _parseVersion as parseVersion, _satisfiesRange as satisfiesRange, MANIFEST_FILENAME, } from './plugin-manifest.js';
+import { _readPluginManifest as readPluginManifest, _isMonorepo as isMonorepo, _getEnabledPlugins as getEnabledPlugins, _parseVersion as parseVersion, _satisfiesRange as satisfiesRange, MANIFEST_FILENAME, validatePluginAuthor, } from './plugin-manifest.js';
+// ── Author metadata ─────────────────────────────────────────────────────────
+describe('validatePluginAuthor', () => {
+    it('normalizes valid author metadata', () => {
+        expect(validatePluginAuthor({ name: ' Rishabh ', handle: 'rishabhraj36' })).toEqual({
+            name: 'Rishabh',
+            handle: 'rishabhraj36',
+        });
+    });
+    it('rejects missing author fields', () => {
+        expect(() => validatePluginAuthor({ name: '', handle: 'rishabhraj36' })).toThrow('author.name');
+        expect(() => validatePluginAuthor({ name: 'Rishabh', handle: '' })).toThrow('author.handle');
+    });
+    it('rejects malformed GitHub handles', () => {
+        expect(() => validatePluginAuthor({ name: 'Rishabh', handle: '-wrong' })).toThrow('author.handle');
+        expect(() => validatePluginAuthor({ name: 'Rishabh', handle: 'wrong--handle' })).toThrow('author.handle');
+        expect(() => validatePluginAuthor({ name: 'Rishabh', handle: `${'a'.repeat(39)}b` })).toThrow('author.handle');
+    });
+});
 // ── readPluginManifest ──────────────────────────────────────────────────────
 describe('readPluginManifest', () => {
     let tmpDir;

package/dist/src/plugin-scaffold.d.ts

@@ -11,11 +11,14 @@
  *     greet.ts              — sample TS command using func()
  *     README.md             — basic documentation
  */
+import { type PluginAuthor } from './plugin-manifest.js';
 export interface ScaffoldOptions {
     /** Directory to create the plugin in. Defaults to `./<name>` */
     dir?: string;
     /** Plugin description */
     description?: string;
+    /** Required author attribution for the generated plugin manifest. */
+    author: PluginAuthor;
 }
 export interface ScaffoldResult {
     name: string;
@@ -25,4 +28,4 @@ export interface ScaffoldResult {
 /**
  * Create a new plugin scaffold directory.
  */
-export declare function createPluginScaffold(name: string, opts?: ScaffoldOptions): ScaffoldResult;
+export declare function createPluginScaffold(name: string, opts: ScaffoldOptions): ScaffoldResult;

package/dist/src/plugin-scaffold.js

@@ -13,16 +13,18 @@
  */
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { validatePluginAuthor } from './plugin-manifest.js';
 import { PKG_VERSION } from './version.js';
 /**
  * Create a new plugin scaffold directory.
  */
-export function createPluginScaffold(name, opts = {}) {
+export function createPluginScaffold(name, opts) {
     // Validate name
     if (!/^[a-z][a-z0-9-]*$/.test(name)) {
         throw new Error(`Invalid plugin name "${name}". ` +
             `Plugin names must start with a lowercase letter and contain only lowercase letters, digits, and hyphens.`);
     }
+    const author = validatePluginAuthor(opts.author);
     const targetDir = opts.dir
         ? path.resolve(opts.dir)
         : path.resolve(name);
@@ -37,6 +39,7 @@ export function createPluginScaffold(name, opts = {}) {
         version: '0.1.0',
         description: opts.description ?? `A webcmd plugin: ${name}`,
         webcmd: `>=${PKG_VERSION}`,
+        author,
     };
     writeFile(targetDir, 'webcmd-plugin.json', JSON.stringify(manifest, null, 2) + '\n');
     files.push('webcmd-plugin.json');

package/dist/src/plugin-scaffold.test.js

@@ -8,6 +8,7 @@ import * as path from 'node:path';
 import { createPluginScaffold } from './plugin-scaffold.js';
 describe('createPluginScaffold', () => {
     const createdDirs = [];
+    const author = { name: 'Rishabh', handle: 'rishabhraj36' };
     afterEach(() => {
         for (const dir of createdDirs) {
             try {
@@ -20,7 +21,7 @@ describe('createPluginScaffold', () => {
     it('creates all expected files', () => {
         const dir = path.join(os.tmpdir(), `webcmd-scaffold-${Date.now()}`);
         createdDirs.push(dir);
-        const result = createPluginScaffold('my-test', { dir });
+        const result = createPluginScaffold('my-test', { dir, author });
         expect(result.name).toBe('my-test');
         expect(result.dir).toBe(dir);
         expect(result.files).toContain('webcmd-plugin.json');
@@ -36,25 +37,27 @@ describe('createPluginScaffold', () => {
     it('generates valid webcmd-plugin.json', () => {
         const dir = path.join(os.tmpdir(), `webcmd-scaffold-${Date.now()}`);
         createdDirs.push(dir);
-        createPluginScaffold('test-manifest', { dir, description: 'Test desc' });
+        createPluginScaffold('test-manifest', { dir, description: 'Test desc', author });
         const manifest = JSON.parse(fs.readFileSync(path.join(dir, 'webcmd-plugin.json'), 'utf-8'));
         expect(manifest.name).toBe('test-manifest');
         expect(manifest.version).toBe('0.1.0');
         expect(manifest.description).toBe('Test desc');
         expect(manifest.webcmd).toMatch(/^>=/);
+        expect(manifest.author).toEqual(author);
     });
     it('generates ESM package.json', () => {
         const dir = path.join(os.tmpdir(), `webcmd-scaffold-${Date.now()}`);
         createdDirs.push(dir);
-        createPluginScaffold('test-pkg', { dir });
+        createPluginScaffold('test-pkg', { dir, author });
         const pkg = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf-8'));
         expect(pkg.type).toBe('module');
         expect(pkg.peerDependencies?.['@agentrhq/webcmd']).toBeDefined();
+        expect(pkg.author).toBeUndefined();
     });
     it('generates a TS sample that matches the current plugin API', () => {
         const dir = path.join(os.tmpdir(), `webcmd-scaffold-${Date.now()}`);
         createdDirs.push(dir);
-        createPluginScaffold('test-ts', { dir });
+        createPluginScaffold('test-ts', { dir, author });
         const tsSample = fs.readFileSync(path.join(dir, 'greet.ts'), 'utf-8');
         expect(tsSample).toContain(`import { cli, Strategy } from '@agentrhq/webcmd/registry';`);
         expect(tsSample).toContain(`strategy: Strategy.PUBLIC`);
@@ -65,19 +68,31 @@ describe('createPluginScaffold', () => {
     it('documents a supported local install flow', () => {
         const dir = path.join(os.tmpdir(), `webcmd-scaffold-${Date.now()}`);
         createdDirs.push(dir);
-        createPluginScaffold('test-readme', { dir });
+        createPluginScaffold('test-readme', { dir, author });
         const readme = fs.readFileSync(path.join(dir, 'README.md'), 'utf-8');
         expect(readme).toContain(`webcmd plugin install file://${dir}`);
     });
     it('rejects invalid names', () => {
-        expect(() => createPluginScaffold('Bad_Name')).toThrow('Invalid plugin name');
-        expect(() => createPluginScaffold('123start')).toThrow('Invalid plugin name');
+        expect(() => createPluginScaffold('Bad_Name', { author })).toThrow('Invalid plugin name');
+        expect(() => createPluginScaffold('123start', { author })).toThrow('Invalid plugin name');
+    });
+    it('rejects missing or malformed author metadata before creating files', () => {
+        const missingDir = path.join(os.tmpdir(), `webcmd-scaffold-missing-author-${Date.now()}`);
+        const malformedDir = path.join(os.tmpdir(), `webcmd-scaffold-malformed-author-${Date.now()}`);
+        createdDirs.push(missingDir, malformedDir);
+        expect(() => createPluginScaffold('missing-author', { dir: missingDir })).toThrow('author');
+        expect(() => createPluginScaffold('malformed-author', {
+            dir: malformedDir,
+            author: { name: 'Rishabh', handle: '-wrong' },
+        })).toThrow('author.handle');
+        expect(fs.existsSync(missingDir)).toBe(false);
+        expect(fs.existsSync(malformedDir)).toBe(false);
     });
     it('rejects non-empty directory', () => {
         const dir = path.join(os.tmpdir(), `webcmd-scaffold-${Date.now()}`);
         createdDirs.push(dir);
         fs.mkdirSync(dir, { recursive: true });
         fs.writeFileSync(path.join(dir, 'existing.txt'), 'x');
-        expect(() => createPluginScaffold('test', { dir })).toThrow('not empty');
+        expect(() => createPluginScaffold('test', { dir, author })).toThrow('not empty');
     });
 });

package/dist/src/plugin.js

@@ -485,7 +485,10 @@ function installDependencies(dir) {
     if (!fs.existsSync(pkgJsonPath))
         return;
     try {
-        execFileSync('npm', ['install', '--omit=dev'], {
+        // Plugin repositories and their transitive dependencies are untrusted.
+        // Webcmd adapters do not require install-time lifecycle scripts, so deny
+        // preinstall/install/postinstall execution with the user's privileges.
+        execFileSync('npm', ['install', '--omit=dev', '--ignore-scripts'], {
             cwd: dir,
             encoding: 'utf-8',
             stdio: ['pipe', 'pipe', 'pipe'],

package/dist/src/plugin.test.js

@@ -564,6 +564,19 @@ describe('installDependencies', () => {
         expect(() => _installDependencies(failingDir)).toThrow('npm install failed');
         fs.rmSync(tmpDir, { recursive: true, force: true });
     });
+    it('runs npm install with --ignore-scripts so untrusted lifecycle scripts cannot execute', () => {
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'webcmd-plugin-scripts-'));
+        const pluginDir = path.join(tmpDir, 'plugin-c');
+        fs.mkdirSync(pluginDir, { recursive: true });
+        fs.writeFileSync(path.join(pluginDir, 'package.json'), JSON.stringify({ name: 'plugin-c' }));
+        _installDependencies(pluginDir);
+        expect(mockExecFileSync).toHaveBeenCalledTimes(1);
+        const [bin, args] = mockExecFileSync.mock.calls[0];
+        expect(bin).toBe('npm');
+        expect(args).toContain('install');
+        expect(args).toContain('--ignore-scripts');
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    });
 });
 describe('postInstallMonorepoLifecycle', () => {
     let repoDir;

package/dist/src/registry.d.ts

@@ -2,6 +2,7 @@
  * Core registry: Strategy enum, Arg/CliCommand interfaces, cli() registration.
  */
 import type { IPage } from './types.js';
+import type { FileArgumentContract } from './hosted/contract.js';
 export declare enum Strategy {
     PUBLIC = "public",
     LOCAL = "local",
@@ -18,6 +19,7 @@ export interface Arg {
     positional?: boolean;
     help?: string;
     choices?: string[];
+    file?: FileArgumentContract;
 }
 export type CommandArgs = Record<string, any>;
 export type BrowserCommandFunc = (page: IPage, kwargs: CommandArgs, debug?: boolean) => Promise<unknown>;

package/dist/src/release-notes.js

@@ -8,6 +8,7 @@ export const RELEASE_NOTE_SECTIONS = [
 const SQUASH_MERGE_PR_NUMBER_PATTERN = /\(#(?<number>\d+)\)\s*$/;
 const MERGE_COMMIT_PR_NUMBER_PATTERN = /^Merge pull request #(?<number>\d+) /;
 const RELEASE_PLEASE_TITLE_PATTERN = /^chore(?:\([^)]+\))?: release(?:\s|$)/;
+const CONTRIBUTOR_AVATAR_SIZE = 40;
 const SERVICE_ACCOUNT_HANDLES = new Set([
     'allcontributors',
     'copilot-pull-request-reviewer',
@@ -82,9 +83,16 @@ function parseReleaseSemver(tag) {
 }
 export function isMajorRelease(context) {
     const current = parseReleaseSemver(context.tag);
-    if (!current || current.major === 0)
+    if (!current)
         return false;
     const previous = parseReleaseSemver(context.previousTag);
+    if (current.major === 0) {
+        if (current.minor === 0 || current.patch !== 0)
+            return false;
+        if (!previous)
+            return true;
+        return previous.major === 0 && current.minor > previous.minor;
+    }
     if (!previous)
         return current.minor === 0 && current.patch === 0;
     return current.major > previous.major;
@@ -122,7 +130,7 @@ function githubHandleUrl(handle) {
 function formatContributorAvatar(handle) {
     const escapedHandle = escapeHtml(handle);
     const encodedHandle = encodeURIComponent(handle);
-    return `<a href="${githubHandleUrl(handle)}" title="@${escapedHandle}"><img src="https://github.com/${encodedHandle}.png?size=64" width="64" height="64" alt="@${escapedHandle}" /></a>`;
+    return `<a href="${githubHandleUrl(handle)}" title="@${escapedHandle}"><img src="https://github.com/${encodedHandle}.png?size=${CONTRIBUTOR_AVATAR_SIZE}" width="${CONTRIBUTOR_AVATAR_SIZE}" height="${CONTRIBUTOR_AVATAR_SIZE}" alt="@${escapedHandle}" /></a>`;
 }
 function formatContributorLink(handle) {
     return `[@${handle}](${githubHandleUrl(handle)})`;
@@ -132,7 +140,7 @@ function formatContributorsSection(handles) {
         return null;
     return [
         '## Contributors',
-        handles.map(formatContributorAvatar).join('\n'),
+        handles.map(formatContributorAvatar).join(' '),
         '',
         handles.map(formatContributorLink).join(' | '),
     ].join('\n');
@@ -140,7 +148,7 @@ function formatContributorsSection(handles) {
 function stripContributorAvatarLines(notes) {
     return notes
         .split(/\r?\n/)
-        .filter((line) => !(/<img\b/i.test(line) && /https:\/\/github\.com\/[^"'\s>]+\.png\?size=64/.test(line)))
+        .filter((line) => !(/<img\b/i.test(line) && /https:\/\/github\.com\/[^"'\s>]+\.png\?size=\d+/.test(line)))
         .join('\n')
         .replace(/(^|\n)(## Contributors)\n\n/g, '$1$2\n')
         .replace(/\n{3,}/g, '\n\n')