@cat-factory/executor-harness 1.72.0 → 1.74.0

package/dist/job.js

@@ -309,8 +309,12 @@ export function parsePackageRegistries(value, env = process.env) {
         if (!allowed.has(host)) {
             throw new Error(`Invalid job: 'packageRegistries[${i}].host' '${host}' is not an allowed npm registry host`);
         }
-        if (!Array.isArray(entry.scopes) || entry.scopes.length === 0) {
-            throw new Error(`Invalid job: 'packageRegistries[${i}].scopes' must be a non-empty array`);
+        // An EMPTY scope list is valid and deliberate: the entry then only authenticates its
+        // host, leaving every package to resolve from the default registry unless a dependency
+        // pins this one itself. Mapping a scope is all-or-nothing, so a workspace mixing private
+        // and public packages under one scope must be able to skip it.
+        if (!Array.isArray(entry.scopes)) {
+            throw new Error(`Invalid job: 'packageRegistries[${i}].scopes' must be an array`);
         }
         const scopes = entry.scopes.map((scope, j) => {
             const s = str(scope, `packageRegistries[${i}].scopes[${j}]`).trim();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/executor-harness",
-  "version": "1.72.0",
+  "version": "1.74.0",
   "description": "Container payload: a thin TypeScript wrapper that runs the Pi coding agent against a cloned repo and opens a PR. Runs in the Cloudflare Container (and, in local native mode, as a host process); carries no secrets.",
   "repository": {
     "type": "git",
@@ -26,9 +26,9 @@
     "hono": "^4.12.32",
     "typescript": "7.0.2",
     "vitest": "^4.1.10",
-    "@cat-factory/kernel": "0.184.0",
-    "@cat-factory/server": "0.172.0",
-    "@cat-factory/spend": "0.12.113"
+    "@cat-factory/kernel": "0.185.1",
+    "@cat-factory/server": "0.172.2",
+    "@cat-factory/spend": "0.12.115"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",

package/src/job.ts

@@ -420,7 +420,7 @@ export interface PackageRegistrySpec {
   ecosystem: 'npm'
   /** Registry host, e.g. `registry.npmjs.org` — allowlisted, never a full URL. */
   host: string
-  /** npm scopes (`@org`) routed to this registry. */
+  /** npm scopes (`@org`) routed to this registry; EMPTY ⇒ authenticate the host only. */
   scopes: string[]
   token: string
 }
@@ -468,8 +468,12 @@ export function parsePackageRegistries(
         `Invalid job: 'packageRegistries[${i}].host' '${host}' is not an allowed npm registry host`,
       )
     }
-    if (!Array.isArray(entry.scopes) || entry.scopes.length === 0) {
-      throw new Error(`Invalid job: 'packageRegistries[${i}].scopes' must be a non-empty array`)
+    // An EMPTY scope list is valid and deliberate: the entry then only authenticates its
+    // host, leaving every package to resolve from the default registry unless a dependency
+    // pins this one itself. Mapping a scope is all-or-nothing, so a workspace mixing private
+    // and public packages under one scope must be able to skip it.
+    if (!Array.isArray(entry.scopes)) {
+      throw new Error(`Invalid job: 'packageRegistries[${i}].scopes' must be an array`)
     }
     const scopes = entry.scopes.map((scope, j) => {
       const s = str(scope, `packageRegistries[${i}].scopes[${j}]`).trim()