@andromarces/agent-loops 0.2.0 → 0.2.2

package/README.md

@@ -245,7 +245,7 @@ happens only through explicit invocation.
   `--dangerously-bypass-hook-trust` for normal use.
 - The Copilot CLI entry point is `src/entrypoints/copilot.mjs`, exposed as
   `agent-loop-copilot`. It mints a UUID, starts
-  `copilot --session-id <uuid> --interactive <prompt>`, and includes the
+  `copilot --session-id <uuid> --add-dir <docs dir> --interactive <prompt>`, and includes the
   instruction file, task, and same id for `--parent-session` in the first
   prompt. The current CLI documentation exposes no custom command-template
   session-id placeholder, so the launcher is the native entry point.
@@ -428,6 +428,31 @@ pnpm lint        # Lint files with oxlint
 pnpm test        # Run Vitest test suite
 ```
 
+## Releasing
+
+The release workflow stages a version on a published GitHub release or a manual dispatch, authenticated by OIDC trusted publishing. No npm token is stored.
+
+npm requires the package to exist before a trusted publisher can be configured, so the first version is published once from a checkout:
+
+```bash
+npm login
+npm publish
+```
+
+Then add a trusted publisher on npmjs.com: package settings, **Trusted publishing**, **GitHub Actions**, organization or user `andromarces`, repository `agent-loops`, workflow filename `release.yml`, allowed actions `npm stage publish`.
+
+For later releases, bump the version, then publish a GitHub release with tag `v<version>`. The tag must match the `package.json` version. The workflow runs `npm stage publish` and prints a stage id. Review and approve the staged version with 2FA:
+
+```bash
+npm stage list
+npm stage view <stage-id>
+npm stage approve <stage-id>
+```
+
+A manual dispatch must run on the release tag, for example `gh workflow run release.yml --ref v<version>`. A dispatch on a branch is rejected, because npm records provenance from the run ref, not the checked-out commit.
+
+The version goes live only after approval. Staged publishing needs npm 11.15.0 or later and 2FA on the account.
+
 ## Manual smoke test
 
 Run against real CLI agents in a temporary Git repository:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andromarces/agent-loops",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "private": false,
   "description": "Run a task loop across several CLI coding agents.",
   "homepage": "https://github.com/andromarces/agent-loops#readme",
@@ -13,9 +13,9 @@
     "url": "git+https://github.com/andromarces/agent-loops.git"
   },
   "bin": {
-    "agent-loop": "./src/cli.mjs",
-    "agent-loop-copilot": "./src/entrypoints/copilot.mjs",
-    "agent-loops": "./src/cli.mjs"
+    "agent-loop": "src/cli.mjs",
+    "agent-loop-copilot": "src/entrypoints/copilot.mjs",
+    "agent-loops": "src/cli.mjs"
   },
   "files": [
     "src",

package/src/entrypoints/copilot.mjs

@@ -13,13 +13,18 @@ import { isEntryPoint } from "../lib/entrypoint.mjs";
 const INSTRUCTIONS_DIR = fileURLToPath(new URL("../../docs", import.meta.url));
 const INSTRUCTIONS_PATH = join(INSTRUCTIONS_DIR, "orchestrator-instructions.md");
 
+// The prompt is one line. execa rejects CR or LF in an argument on Windows when
+// it spawns a batch shim through cmd.exe, and npm installs the copilot CLI as a
+// .cmd shim on Windows.
 const INSTRUCTIONS = (sessionId, task) =>
   [
     `Read \`${INSTRUCTIONS_PATH}\` and follow it for this request.`,
     "The task and role settings are:",
     task,
     `This Copilot CLI session id is \`${sessionId}\`. Pass it as \`--parent-session\` on the init dispatch call.`,
-  ].join("\n\n");
+  ]
+    .join(" ")
+    .replace(/[\r\n]+/g, " ");
 
 export function buildCopilotInvocation(task, sessionId) {
   const normalizedTask = String(task ?? "").trim();