@groeponline/pi-wishcraft 0.23.0 → 0.23.2

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## [Unreleased]
 
+## [0.23.2] - 2026-08-20
+
+### Fixed
+- Release workflow creates a GitHub Release for each tag so the Releases page Latest matches npm.
+
+## [0.23.1] - 2026-08-20
+
+### Fixed
+- Per-segment fault isolation: a throwing custom `command` segment shows `!id` instead of blanking the footer.
+- `open_ports` parses macOS netstat dot-separated local addresses (`*.5900`, `127.0.0.1.631`).
+
 ## [0.23.0] - 2026-08-20
 
 ### Added

package/RELEASE.md

@@ -20,11 +20,12 @@ verify it.
 **Default:** every merge to `main` is a release. `.github/workflows/release.yml`
 runs `node scripts/release.mjs auto --push` on `main` and publishes in that
 same job (`scripts/npm-publish.sh`) with the GroepOnline org secret
-`NPM_TOKEN`. A tag pushed with `GITHUB_TOKEN` does **not** start another
-workflow, so publish cannot wait for the tag event. Manual SSH/PAT tag
-pushes still run the tag job. `auto` reads commit subjects since the last
-`v*` tag: `feat:` → minor, `feat!:` / `BREAKING CHANGE` → major, otherwise
-patch.
+`NPM_TOKEN`, then creates a GitHub Release for the tag
+(`scripts/github-release.sh`) so the Releases page Latest matches npm. A tag
+pushed with `GITHUB_TOKEN` does **not** start another workflow, so publish
+cannot wait for the tag event. Manual SSH/PAT tag pushes still run the tag
+job. `auto` reads commit subjects since the last `v*` tag: `feat:` → minor,
+`feat!:` / `BREAKING CHANGE` → major, otherwise patch.
 
 The first merge after `v0.18.0` therefore becomes **0.19.0** (the 0.19
 `feat:` commits are already on `main`). Later docs/fix merges become
@@ -78,6 +79,7 @@ start a second run.
 7. `npm run verify:package` (catalog contract gate — see `scripts/verify-package.mjs`)
 8. `node scripts/release.mjs auto --push` (main only)
 9. `sh scripts/npm-publish.sh` with `NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}` (fail-closed `npm view`, idempotent skip, then the Pi catalog URLs)
+10. `sh scripts/github-release.sh` with `GITHUB_TOKEN` (idempotent: skip if that tag already has a Release; notes from `CHANGELOG.md`)
 
 `NPM_TOKEN` is the GroepOnline **org** Actions secret (publish rights to the
 `@groeponline` scope). This repo has no override; Actions inherits the org
@@ -109,10 +111,14 @@ gh run view <databaseId> --repo GroepOnline/pi-wishcraft \
 # 4. npm registry (published + propagated)
 npm view @groeponline/pi-wishcraft version        # 0.15.0
 npm view @groeponline/pi-wishcraft dist-tags      # { latest: '0.15.0' }
+
+# 5. GitHub Release Latest matches npm
+gh release list --repo GroepOnline/pi-wishcraft --limit 5
 ```
 
-A release is "done" when all four hold: local green, tag on origin, CI
-`success`, and `npm view` returns the new version.
+A release is "done" when all five hold: local green, tag on origin, CI
+`success`, `npm view` returns the new version, and GitHub Releases Latest
+is that same tag.
 
 ## Known gotchas
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groeponline/pi-wishcraft",
-  "version": "0.23.0",
+  "version": "0.23.2",
   "description": "Wishcraft cockpit for the pi coding agent — powerline status, vibes, idea inbox, bash mode, and full customization.",
   "type": "module",
   "files": [

package/src/segments/custom.ts

@@ -35,7 +35,9 @@ function runCommandCached(
       commandCache.set(command, { at: now, value: out });
     return out;
   } catch {
-    return null;
+    // Preserve command failures so renderSegment can isolate this segment and
+    // expose a visible fault marker instead of silently hiding it.
+    throw new Error(`Command failed: ${command}`);
   }
 }
 

package/src/segments/registry.ts

@@ -164,16 +164,24 @@ export function renderSegment(
   id: StatusLineSegmentId,
   ctx: SegmentContext,
 ): RenderedSegment {
-  let rendered: RenderedSegment;
-  if (isCustomSegmentId(id)) {
-    const customId = id.slice("custom:".length);
-    const computed = customComputedSegments.get(customId);
-    rendered = computed
-      ? computed.render(ctx)
-      : renderCustomSegment(id, ctx);
-  } else {
-    const segment = SEGMENTS[id];
-    rendered = segment ? segment.render(ctx) : { content: "", visible: false };
+  try {
+    let rendered: RenderedSegment;
+    if (isCustomSegmentId(id)) {
+      const customId = id.slice("custom:".length);
+      const computed = customComputedSegments.get(customId);
+      rendered = computed
+        ? computed.render(ctx)
+        : renderCustomSegment(id, ctx);
+    } else {
+      const segment = SEGMENTS[id];
+      rendered = segment ? segment.render(ctx) : { content: "", visible: false };
+    }
+    return applySegmentDecoration(id, ctx, rendered);
+  } catch {
+    // ponytail: per-segment fault isolation. A throwing segment (most often a
+    // user `command` custom segment with a failing script) must not blank the
+    // whole footer; surface a visible `!id` marker so the operator sees
+    // which segment broke. No per-render log: the bar repaints ~30/s.
+    return { content: `!${id}`, visible: true };
   }
-  return applySegmentDecoration(id, ctx, rendered);
 }

package/src/segments/system.ts

@@ -180,7 +180,21 @@ export function countListeningPorts(includeUdp = false, host?: string): number {
     return host ? -1 : readProcListeningPorts(includeUdp);
   }
 
-  const lines = out
+  return parseListeningPortsFromText(out).size;
+}
+
+/**
+ * Pure port-count parser shared by `countListeningPorts`. Accepts `ss` and
+ * `netstat` output. The port separator is `:` on Linux/`ss`/`lsof` but `.` on
+ * macOS `netstat` (`*.5900`, `127.0.0.1.631`); matching both keeps the
+ * open-ports segment honest on macOS.
+ *
+ * ponytail: assumes LISTEN rows always carry a port on the local-address
+ * column; a bare IPv4 with no port (not emitted by LISTEN output) would
+ * false-match the `.<digits>` form.
+ */
+export function parseListeningPortsFromText(text: string): Set<number> {
+  const lines = text
     .split("\n")
     .map((l) => l.trim())
     .filter(Boolean);
@@ -189,14 +203,14 @@ export function countListeningPorts(includeUdp = false, host?: string): number {
   for (const line of lines.slice(start)) {
     // ss/netstat put the local address at different columns; take the first addr:port token
     for (const col of line.split(/\s+/)) {
-      const m = /:(\d+)$/.exec(col);
+      const m = /(?::|\.)(\d+)$/.exec(col);
       if (m) {
         ports.add(Number(m[1]));
         break;
       }
     }
   }
-  return ports.size;
+  return ports;
 }
 
 function readProcListeningPorts(includeUdp: boolean): number {
@@ -259,7 +273,7 @@ export function parseOpenPortProcesses(text: string): OpenPortProcess[] {
     // numeric Recv-Q there. That tells us which local-address column to use.
     const isSsRow = !/^\d+$/.test(tokens[1] ?? "");
     const local = isSsRow ? tokens[4] : tokens[3];
-    const portMatch = local ? /:(\d+)$/.exec(local) : null;
+    const portMatch = local ? /(?::|\.)(\d+)$/.exec(local) : null;
     if (!portMatch) continue;
 
     let process: string | null = null;
@@ -275,7 +289,7 @@ export function parseOpenPortProcesses(text: string): OpenPortProcess[] {
     entries.push({
       port: Number(portMatch[1]),
       proto: tokens[0].toLowerCase().startsWith("udp") ? "udp" : "tcp",
-      address: local.replace(/:(\d+)$/, ""),
+      address: local.replace(/(?::|\.)(\d+)$/, ""),
       process,
     });
   }