@fitchmultz/pi-subagents 0.52.5 → 0.52.6

package/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 ## [Unreleased]
 
+## 0.52.6 - 2026-11-01
+
+<!-- npm-release:unreleased:start -->
+
+- Qualify a retained npm candidate through the native child and package-install smoke on the selected Pi hosts.
+- Reconcile main-branch changes into reviewed patch releases and publish the qualified archive to npm and GitHub.
+
+<!-- npm-release:unreleased:end -->
+
+- Automate qualified npm releases (#315) ([e769f2d](https://github.com/fitchmultz/pi-subagents/commit/e769f2d62f4b731f56e301160b57929a3a0cec6b))
+
+### What's Changed
+
+- Qualify retained Subagents candidates on native hosts (1/2) by @fitchmultz in https://github.com/fitchmultz/pi-subagents/pull/314
+- Automate qualified Subagents releases (2/2) by @fitchmultz in https://github.com/fitchmultz/pi-subagents/pull/315
+
+**Full Changelog**: https://github.com/fitchmultz/pi-subagents/compare/v0.52.5...v0.52.6
+
 ## [0.52.5] - 2026-10-31
 
 ### Fixed

package/dist/build-info.js

@@ -1 +1 @@
-export const EXTENSION_BUILD = Object.freeze({"version":"0.52.5","sha256":"ccb2b2cb4725bfa7f5e813494a2007dc60ed9c04e677502d08df23612cc30af8"});
+export const EXTENSION_BUILD = Object.freeze({"version":"0.52.6","sha256":"ccb2b2cb4725bfa7f5e813494a2007dc60ed9c04e677502d08df23612cc30af8"});

package/docs/development.md

@@ -65,15 +65,25 @@ commands. Matching versions do not establish matching runtime behavior.
 
 Production-only installs must resolve the selected host's SDK and TypeBox, not
 shadow them with this package's development graph. Exercise the packed single
-entry through the real Pi loader and an actual native child session. Native faux
-providers can test tools, receipts, journals, process lifecycle and output without
-paid model calls; they are not live-model evidence.
+entry through the real Pi loader and an actual native child session. When release
+CI receives a prepared candidate, it verifies the candidate and selected host
+identities and exercises that same tarball through the native package smoke.
+Native faux providers can test tools, receipts, journals, process lifecycle and
+output without paid model calls; they are not live-model evidence.
 
 Real-model acceptance additionally checks that full forked history preserves an
 actual earlier delegation result, and that ordinary main/child sessions discover,
 message, and read last responses across agent directories under the confirmed
 two-level topology. Never publish credentials or private transcripts as evidence.
 
+## npm releases
+
+Main-branch changes are reconciled into a reviewed patch-version PR. After that PR
+merges, release CI prepares one npm candidate and runs the complete host CI and
+native package smoke against it. The qualification receipt binds the candidate,
+source, host identities and workflow run before the same archive is published to
+npm and attached to the matching GitHub release.
+
 ## Isolation and safety
 
 Every test/smoke broker uses a short, explicit `PI_INTERCOM_RUNTIME_DIR` owned by

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fitchmultz/pi-subagents",
-  "version": "0.52.5",
+  "version": "0.52.6",
   "description": "Pi extension for subagent orchestration and local session coordination",
   "license": "MIT",
   "type": "module",

package/scripts/package-smoke.mjs

@@ -12,19 +12,21 @@ import {
   writeFileSync,
 } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { hostRoot } from "./compat-host.mjs";
 import { compilerInvocation } from "./typescript.mjs";
 
 if (process.argv.includes("--help") || process.argv.includes("-h")) {
   console.log(
-    "Usage: node scripts/package-smoke.mjs\n\nPack and install the single-entry package without development dependencies. Verify host SDK/TypeBox identity and execute a real native actor using a credential-free local provider. No publication or paid model calls.\nExit codes: 0 passed; 1 packaging, native execution or cleanup failed.",
+    "Usage: node scripts/package-smoke.mjs [tarball]\n\nPack and install the single-entry package without development dependencies, or test an existing tarball unchanged. Verify host SDK/TypeBox identity and execute a real native actor using a credential-free local provider. No publication or paid model calls.\nExit codes: 0 passed; 1 packaging, native execution or cleanup failed.",
   );
   process.exit(0);
 }
+assert.ok(process.argv.length <= 3, "Expected at most one package tarball; use --help");
 
 const packageJson = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+const candidate = process.argv[2] ? resolve(process.argv[2]) : undefined;
 const root = mkdtempSync(join(tmpdir(), "ps-package-"));
 const packDir = join(root, "pack");
 mkdirSync(packDir);
@@ -202,9 +204,25 @@ try {
   verifyManifest(packageJson);
   process.env.PI_PACKAGE_DIR = hostRoot;
   const pack = Object.values(
-    JSON.parse(run("npm", ["pack", "--json", "--pack-destination", packDir])),
+    JSON.parse(
+      run("npm", [
+        "pack",
+        "--json",
+        "--pack-destination",
+        packDir,
+        ...(candidate ? [candidate] : []),
+      ]),
+    ),
   )[0];
   assert.ok(pack && Array.isArray(pack.files), "npm pack must report files");
+  if (candidate) {
+    assert.equal(pack.name, packageJson.name);
+    assert.equal(pack.version, packageJson.version, "Candidate version differs from source");
+    assert.ok(
+      readFileSync(join(packDir, pack.filename)).equals(readFileSync(candidate)),
+      "npm changed the candidate tarball",
+    );
+  }
   const paths = new Set(pack.files.map((file) => file.path));
   for (const path of [
     "package.json",