@hasna/skills 0.1.61 → 0.1.62

package/agent-skills/skill-publish/SKILL.md

@@ -90,7 +90,7 @@ If tests fail → fix them before continuing. Never publish broken tests.
 ```bash
 git add package.json bun.lock
 SECRET_PATTERN='sk-(ant|proj)-|npm_[[:alpha:]]|gh[op]_|AKIA[[:upper:][:digit:]]|xai[-]|AI[z]a'
-if git diff --cached --diff-filter=ACM --unified=0 | grep -iE "^\\+[^+].*($SECRET_PATTERN)"; then
+if git diff --cached --diff-filter=ACM --unified=0 | grep -iE "^\\+([^+].*)?($SECRET_PATTERN)"; then
   echo "SECRETS - STOP"
   exit 1
 fi
@@ -121,7 +121,7 @@ test "$(cat package.json | python3 -c "import sys,json; print(json.load(sys.stdi
 ### 7. Post publish intent to git-publishing (BEFORE publishing)
 
 Fleet rule: publish intent goes to the `git-publishing` channel BEFORE any
-`bun publish`/`npm publish`, and the result is confirmed in the same thread
+`npm publish`, and the result is confirmed in the same thread
 after. Re-check blockers first — an unread `[FREEZE]` means stop and escalate
 to `help`.
 
@@ -136,17 +136,62 @@ echo "Intent posted: message $INTENT_ID"
 
 ### 8. Publish
 
+Npm 10.9.8 and 11.16.0 both omit `gitHead` when they publish directly from a
+linked Git worktree, because their package normalizer treats `.git` as a
+directory and silently ignores the worktree's `.git` file. Publish through the
+deterministic helper beside this SKILL.md. It packs the prepared package, stages
+those files in a disposable normal clone at the exact source HEAD/tree, preserves
+the package's repository-relative subdirectory, and never mutates the source
+worktree's Git metadata.
+
+Resolve `PUBLISH_HELPER` to `scripts/publish_with_git_head.sh` beside this
+SKILL.md in the installed skill directory. Do not copy the helper into the
+package repo or replace it with raw `npm publish`.
+
 ```bash
 ACCESS=public
 [ "$ORG" = "hasnaxyz" ] && ACCESS=restricted
-if command -v bun >/dev/null 2>&1; then
-  bun publish --access "$ACCESS"
-elif command -v npm >/dev/null 2>&1; then
-  npm publish --access "$ACCESS"
-else
-  echo "BLOCKED: neither bun nor npm publish is available"
+TOKEN_PATH="$ORG/npm/live/publish-token"
+EXPECTED_GIT_HEAD=$(git rev-parse HEAD)
+PUBLISH_HELPER="<directory containing this SKILL.md>/scripts/publish_with_git_head.sh"
+test -f "$PUBLISH_HELPER"
+
+(
+  NPMRC=$(mktemp)
+  trap 'rm -f "$NPMRC"' EXIT
+  chmod 600 "$NPMRC"
+  printf '//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}\n' > "$NPMRC"
+  secrets exec "$TOKEN_PATH" --as NODE_AUTH_TOKEN -- \
+    bash "$PUBLISH_HELPER" --userconfig "$NPMRC" --access "$ACCESS"
+)
+
+VERIFY_DIR=$(mktemp -d)
+PUBLISHED_GIT_HEAD=""
+for attempt in 1 2 3 4 5; do
+  if npm view "$PKG@$NEW_VERSION" gitHead --json \
+    > "$VERIFY_DIR/githead.out" \
+    2> "$VERIFY_DIR/githead.err"; then
+    if [ -s "$VERIFY_DIR/githead.out" ]; then
+      if PUBLISHED_GIT_HEAD=$(node -e '
+        const fs = require("node:fs");
+        const value = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+        if (typeof value !== "string") process.exit(2);
+        process.stdout.write(value);
+      ' "$VERIFY_DIR/githead.out"); then
+        break
+      fi
+    fi
+  fi
+  sleep 2
+done
+rm -rf "$VERIFY_DIR"
+
+if [ "$PUBLISHED_GIT_HEAD" != "$EXPECTED_GIT_HEAD" ]; then
+  printf 'GITHEAD_OUTPUT: %s\n' "${PUBLISHED_GIT_HEAD:-ABSENT}"
+  printf 'GITHEAD_EXPECTED: %s\n' "$EXPECTED_GIT_HEAD"
   exit 1
 fi
+printf 'GITHEAD_VERIFIED: %s\n' "$PUBLISHED_GIT_HEAD"
 ```
 
 ### 9. Install locally via bun (NOT npm)
@@ -199,6 +244,8 @@ Repo releases (GitHub tags/releases) are announced on `git-releases`, not
 - NEVER publish without running tests and build first
 - NEVER publish with secrets in the staged diff
 - NEVER publish without posting intent to `git-publishing` first (step 7)
+- NEVER publish through raw `bun publish` or `npm publish`; use the worktree-safe helper
+- NEVER report success until registry `gitHead` equals the exact source HEAD
 - ALWAYS confirm in the intent thread after — published or aborted, no silent exits
 - NEVER bump minor or major — patch only unless user explicitly says otherwise
 - NEVER skip the CLI verification step

package/agent-skills/skill-publish/scripts/capture_registry.js

@@ -0,0 +1,47 @@
+import { writeFileSync } from "node:fs";
+import { createServer } from "node:http";
+
+const [prefix, portFile] = process.argv.slice(2);
+const putStatus = Number(process.env.CAPTURE_PUT_STATUS ?? "201");
+let requestIndex = 0;
+
+if (!prefix || !portFile) {
+  throw new Error("usage: capture_registry.js <output-prefix> <port-file>");
+}
+
+const server = createServer((request, response) => {
+  const chunks = [];
+
+  request.on("data", (chunk) => chunks.push(chunk));
+  request.on("end", () => {
+    requestIndex += 1;
+    const body = Buffer.concat(chunks);
+    writeFileSync(
+      `${prefix}.request-${requestIndex}.json`,
+      JSON.stringify(
+        {
+          method: request.method,
+          url: request.url,
+          bodyBytes: body.length,
+        },
+        null,
+        2,
+      ),
+    );
+
+    if (request.method === "PUT") {
+      writeFileSync(`${prefix}.put.json`, body);
+      response.writeHead(putStatus, { "content-type": "application/json" });
+      response.end(JSON.stringify(putStatus < 400 ? { ok: true } : { error: "probe_failure" }));
+      setTimeout(() => server.close(), 25);
+      return;
+    }
+
+    response.writeHead(404, { "content-type": "application/json" });
+    response.end(JSON.stringify({ error: "not_found" }));
+  });
+});
+
+server.listen(0, "127.0.0.1", () => {
+  writeFileSync(portFile, String(server.address().port));
+});

package/agent-skills/skill-publish/scripts/publish_with_git_head.sh

@@ -0,0 +1,143 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+for required_command in git node npm tar; do
+  if ! command -v "$required_command" >/dev/null 2>&1; then
+    printf 'publish_with_git_head: %s is required\n' "$required_command" >&2
+    exit 127
+  fi
+done
+
+package_dir=$(pwd -P)
+if [ ! -f "$package_dir/package.json" ]; then
+  printf 'publish_with_git_head: no package.json in %s\n' "$package_dir" >&2
+  exit 2
+fi
+
+repo_root=$(git -C "$package_dir" rev-parse --show-toplevel)
+head_sha=$(git -C "$repo_root" rev-parse HEAD)
+source_tree=$(git -C "$repo_root" rev-parse "$head_sha^{tree}")
+package_prefix=$(git -C "$package_dir" rev-parse --show-prefix)
+package_relative=${package_prefix%/}
+source_status=$(git -C "$repo_root" status --porcelain --untracked-files=no)
+
+if [ -n "$source_status" ]; then
+  printf 'publish_with_git_head: tracked source changes must be committed before publish\n' >&2
+  exit 2
+fi
+
+temp_root=$(mktemp -d "${TMPDIR:-/tmp}/hasna-publish-githead.XXXXXX")
+clone_root="$temp_root/repo"
+pack_dir="$temp_root/pack"
+unpack_dir="$temp_root/unpack"
+pack_json="$temp_root/pack.json"
+
+cleanup() {
+  local temp_name
+  temp_name=$(basename "$temp_root")
+  case "$temp_name" in
+    hasna-publish-githead.*)
+      rm -rf -- "$temp_root"
+      ;;
+    *)
+      printf 'publish_with_git_head: refusing to remove unexpected temp path %s\n' \
+        "$temp_root" >&2
+      return 1
+      ;;
+  esac
+}
+
+handle_exit() {
+  local command_rc=$?
+  trap - EXIT INT TERM
+  if ! cleanup; then
+    exit 70
+  fi
+  exit "$command_rc"
+}
+
+trap handle_exit EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+mkdir -p "$pack_dir" "$unpack_dir"
+(
+  cd "$package_dir"
+  npm pack --ignore-scripts --json --pack-destination "$pack_dir"
+) > "$pack_json"
+
+tarball_name=$(
+  node -e '
+    const fs = require("node:fs");
+    const result = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+    if (!Array.isArray(result) || result.length !== 1 || !result[0]?.filename) {
+      process.exit(2);
+    }
+    process.stdout.write(result[0].filename);
+  ' "$pack_json"
+)
+tarball="$pack_dir/$tarball_name"
+if [ ! -f "$tarball" ]; then
+  printf 'publish_with_git_head: npm pack did not create %s\n' "$tarball" >&2
+  exit 2
+fi
+
+git clone --quiet --no-hardlinks --no-checkout "$repo_root" "$clone_root"
+git -C "$clone_root" checkout --quiet --detach "$head_sha"
+
+clone_head=$(git -C "$clone_root" rev-parse HEAD)
+clone_tree=$(git -C "$clone_root" rev-parse "HEAD^{tree}")
+clone_status=$(git -C "$clone_root" status --porcelain)
+if [ "$clone_head" != "$head_sha" ] || [ "$clone_tree" != "$source_tree" ]; then
+  printf 'publish_with_git_head: disposable clone does not match source HEAD/tree\n' >&2
+  exit 2
+fi
+if [ -n "$clone_status" ]; then
+  printf 'publish_with_git_head: disposable clone is not clean before staging package files\n' >&2
+  exit 2
+fi
+
+if [ -n "$package_relative" ]; then
+  clone_package_dir="$clone_root/$package_relative"
+else
+  clone_package_dir="$clone_root"
+fi
+if [ ! -d "$clone_package_dir" ]; then
+  printf 'publish_with_git_head: package subdirectory missing in clone: %s\n' \
+    "$package_relative" >&2
+  exit 2
+fi
+
+tar -xzf "$tarball" -C "$unpack_dir"
+cp -a "$unpack_dir/package/." "$clone_package_dir/"
+
+if [ -d "$repo_root/node_modules" ] && [ ! -e "$clone_root/node_modules" ]; then
+  ln -s "$repo_root/node_modules" "$clone_root/node_modules"
+fi
+if [ "$package_dir" != "$repo_root" ] &&
+  [ -d "$package_dir/node_modules" ] &&
+  [ ! -e "$clone_package_dir/node_modules" ]; then
+  ln -s "$package_dir/node_modules" "$clone_package_dir/node_modules"
+fi
+
+node -e '
+  const fs = require("node:fs");
+  const source = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+  const staged = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+  if (source.name !== staged.name || source.version !== staged.version) {
+    process.exit(2);
+  }
+' "$package_dir/package.json" "$clone_package_dir/package.json"
+
+if [ "$(git -C "$repo_root" rev-parse HEAD)" != "$head_sha" ] ||
+  [ "$(git -C "$repo_root" rev-parse "HEAD^{tree}")" != "$source_tree" ]; then
+  printf 'publish_with_git_head: source HEAD/tree changed while preparing publish\n' >&2
+  exit 2
+fi
+
+printf 'publish_with_git_head: publishing %s from disposable clone at HEAD %s\n' \
+  "${package_relative:-.}" "$head_sha" >&2
+(
+  cd "$clone_package_dir"
+  npm publish "$@"
+)

package/agent-skills/skill-publish/scripts/test_publish_with_git_head.sh

@@ -0,0 +1,231 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+helper="$script_dir/publish_with_git_head.sh"
+temp_root=$(mktemp -d)
+source_repo="$temp_root/source"
+source_package="$source_repo/packages/npm-githead-regression"
+linked_worktree="$temp_root/linked-worktree"
+linked_package="$linked_worktree/packages/npm-githead-regression"
+
+cleanup() {
+  rm -rf "$temp_root"
+}
+trap cleanup EXIT INT TERM
+
+if [ ! -f "$helper" ]; then
+  printf 'MISSING_HELPER: %s\n' "$helper"
+  exit 1
+fi
+
+mkdir -p "$source_package"
+git init -q -b main "$source_repo"
+(
+  cd "$source_package"
+  npm init -y > "$temp_root/npm-init.out" 2> "$temp_root/npm-init.err"
+  npm pkg set \
+    name=npm-githead-regression \
+    version=1.0.0 \
+    description="Local npm gitHead regression" \
+    license=MIT \
+    repository.type=git \
+    repository.url=git+https://example.invalid/npm-githead-regression.git \
+    scripts.prepublishOnly="node prepublish-probe.cjs" \
+    > "$temp_root/npm-pkg-set.out" \
+    2> "$temp_root/npm-pkg-set.err"
+)
+node -e '
+  require("node:fs").writeFileSync(
+    process.argv[1],
+    [
+      "const fs = require(\"node:fs\");",
+      "const marker = process.env.PROBE_KILL_MARKER;",
+      "if (marker) {",
+      "  fs.writeFileSync(marker, \"ready\\n\");",
+      "  setInterval(() => {}, 1000);",
+      "}",
+      "",
+    ].join("\n"),
+  );
+' "$source_package/prepublish-probe.cjs"
+git -C "$source_repo" config user.name "Provenance Regression"
+git -C "$source_repo" config user.email "provenance-regression@example.invalid"
+git -C "$source_repo" add packages/npm-githead-regression/package.json \
+  packages/npm-githead-regression/prepublish-probe.cjs
+git -C "$source_repo" commit --no-verify -q -m "test: seed provenance package"
+git -C "$source_repo" worktree add -q -b publish-regression "$linked_worktree" HEAD
+
+expected_head=$(git -C "$linked_worktree" rev-parse HEAD)
+cp "$linked_worktree/.git" "$temp_root/original-gitfile"
+
+start_registry() {
+  local label=$1
+  local status=$2
+  capture_prefix="$temp_root/$label"
+  port_file="$capture_prefix.port"
+
+  CAPTURE_PUT_STATUS="$status" \
+    node "$script_dir/capture_registry.js" "$capture_prefix" "$port_file" \
+      > "$capture_prefix.server.out" \
+      2> "$capture_prefix.server.err" &
+  registry_pid=$!
+
+  for _ in $(seq 1 100); do
+    if [ -s "$port_file" ]; then
+      break
+    fi
+    sleep 0.05
+  done
+  if [ ! -s "$port_file" ]; then
+    printf 'REGISTRY_START: FAILED\n'
+    return 1
+  fi
+  registry_port=$(<"$port_file")
+}
+
+read_git_head() {
+  node -e '
+    const body = JSON.parse(require("node:fs").readFileSync(process.argv[1], "utf8"));
+    const version = Object.values(body.versions)[0];
+    process.stdout.write(version.gitHead ?? "");
+  ' "$1"
+}
+
+assert_source_unchanged() {
+  test -f "$linked_worktree/.git"
+  cmp -s "$linked_worktree/.git" "$temp_root/original-gitfile"
+  test -z "$(git -C "$linked_worktree" status --porcelain)"
+}
+
+assert_no_helper_temp() {
+  local temp_parent=$1
+  if compgen -G "$temp_parent/hasna-publish-githead.*" >/dev/null; then
+    printf 'HELPER_TEMP_REMAINS: %s\n' "$temp_parent"
+    return 1
+  fi
+}
+
+publish_args=(
+  --access public
+  --json
+  --fetch-retries=0
+  --fetch-retry-mintimeout=1
+  --fetch-retry-maxtimeout=1
+)
+
+start_registry plain 201
+(
+  cd "$linked_package"
+  npm publish \
+    --registry "http://127.0.0.1:$registry_port" \
+    "${publish_args[@]}" \
+    "--//127.0.0.1:$registry_port/:_authToken=fake-probe-token"
+) > "$capture_prefix.publish.out" 2> "$capture_prefix.publish.err"
+wait "$registry_pid" 2>/dev/null || true
+plain_head=$(read_git_head "$capture_prefix.put.json")
+if [ -n "$plain_head" ]; then
+  printf 'PLAIN_GITHEAD: %s\n' "$plain_head"
+else
+  printf 'PLAIN_GITHEAD: ABSENT\n'
+fi
+
+success_tmp="$temp_root/success-tmp"
+mkdir "$success_tmp"
+start_registry helper-success 201
+(
+  cd "$linked_package"
+  TMPDIR="$success_tmp" bash "$helper" \
+    --registry "http://127.0.0.1:$registry_port" \
+    "${publish_args[@]}" \
+    "--//127.0.0.1:$registry_port/:_authToken=fake-probe-token"
+) > "$capture_prefix.publish.out" 2> "$capture_prefix.publish.err"
+wait "$registry_pid" 2>/dev/null || true
+helper_head=$(read_git_head "$capture_prefix.put.json")
+printf 'EXPECTED_HEAD: %s\n' "$expected_head"
+printf 'HELPER_GITHEAD: %s\n' "${helper_head:-ABSENT}"
+test "$helper_head" = "$expected_head"
+assert_source_unchanged
+assert_no_helper_temp "$success_tmp"
+printf 'SUCCESS_SOURCE: unchanged\n'
+
+dirty_tmp="$temp_root/dirty-tmp"
+mkdir "$dirty_tmp"
+(
+  cd "$linked_package"
+  npm pkg set description="dirty source must be refused"
+)
+set +e
+(
+  cd "$linked_package"
+  TMPDIR="$dirty_tmp" bash "$helper" --dry-run
+) > "$temp_root/dirty-source.out" 2> "$temp_root/dirty-source.err"
+dirty_rc=$?
+set -e
+test "$dirty_rc" -ne 0
+grep -q 'tracked source changes must be committed' "$temp_root/dirty-source.err"
+assert_no_helper_temp "$dirty_tmp"
+git -C "$linked_worktree" restore packages/npm-githead-regression/package.json
+assert_source_unchanged
+printf 'DIRTY_SOURCE: refused (helper rc=%s)\n' "$dirty_rc"
+
+failure_tmp="$temp_root/failure-tmp"
+mkdir "$failure_tmp"
+start_registry helper-failure 500
+set +e
+(
+  cd "$linked_package"
+  TMPDIR="$failure_tmp" bash "$helper" \
+    --registry "http://127.0.0.1:$registry_port" \
+    "${publish_args[@]}" \
+    "--//127.0.0.1:$registry_port/:_authToken=fake-probe-token"
+) > "$capture_prefix.publish.out" 2> "$capture_prefix.publish.err"
+failure_rc=$?
+set -e
+wait "$registry_pid" 2>/dev/null || true
+test "$failure_rc" -ne 0
+assert_source_unchanged
+assert_no_helper_temp "$failure_tmp"
+printf 'FAILURE_SOURCE: unchanged (publish rc=%s)\n' "$failure_rc"
+
+kill_tmp="$temp_root/kill-tmp"
+mkdir "$kill_tmp"
+kill_marker="$temp_root/kill-ready"
+start_registry helper-kill 201
+(
+  cd "$linked_package"
+  exec setsid env TMPDIR="$kill_tmp" PROBE_KILL_MARKER="$kill_marker" \
+    bash "$helper" \
+      --registry "http://127.0.0.1:$registry_port" \
+      "${publish_args[@]}" \
+      "--//127.0.0.1:$registry_port/:_authToken=fake-probe-token"
+) > "$capture_prefix.publish.out" 2> "$capture_prefix.publish.err" &
+helper_pid=$!
+
+for _ in $(seq 1 400); do
+  if [ -s "$kill_marker" ]; then
+    break
+  fi
+  sleep 0.05
+done
+if [ ! -s "$kill_marker" ]; then
+  printf 'FORCED_TERMINATION_MARKER: ABSENT\n'
+  kill -KILL -- "-$helper_pid" 2>/dev/null || true
+  kill "$registry_pid" 2>/dev/null || true
+  wait "$helper_pid" 2>/dev/null || true
+  wait "$registry_pid" 2>/dev/null || true
+  exit 1
+fi
+
+kill -KILL -- "-$helper_pid" 2>/dev/null || true
+set +e
+wait "$helper_pid" 2>/dev/null
+kill_rc=$?
+set -e
+kill "$registry_pid" 2>/dev/null || true
+wait "$registry_pid" 2>/dev/null || true
+test "$kill_rc" -ne 0
+assert_source_unchanged
+compgen -G "$kill_tmp/hasna-publish-githead.*" >/dev/null
+printf 'FORCED_TERMINATION_SOURCE: unchanged (process rc=%s; disposable clone orphaned)\n' \
+  "$kill_rc"