@pennyfarthing/core 11.3.7 → 11.3.8

package/README.md

@@ -1,6 +1,6 @@
 # Pennyfarthing
 
-**v11.3.7** | *The outer loop goes once, the inner loop goes many times.*
+**v11.3.8** | *The outer loop goes once, the inner loop goes many times.*
 
 <img src="pennyfarthing.png" alt="Pennyfarthing Logo" width="75" style="float:left; margin:10px">
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pennyfarthing/core",
-  "version": "11.3.7",
+  "version": "11.3.8",
   "description": "Claude Code agent framework with TDD workflow and persona system",
   "type": "module",
   "main": "./packages/core/dist/index.js",
@@ -45,19 +45,6 @@
   "bugs": {
     "url": "https://github.com/1898andCo/pennyfarthing/issues"
   },
-  "scripts": {
-    "prepublishOnly": "find pennyfarthing-dist/scripts -name '*.sh' ! -name 'find-root.sh' -exec chmod +x {} +",
-    "postinstall": "node scripts/postinstall.cjs",
-    "build": "pnpm --filter @pennyfarthing/shared build && pnpm --filter @pennyfarthing/core build && pnpm --filter @pennyfarthing/cyclist build && ./scripts/generate-skill-docs.sh",
-    "docs": "./scripts/generate-skill-docs.sh",
-    "dev": "pnpm -r --parallel dev",
-    "test": "pnpm -r test",
-    "lint": "eslint 'packages/*/src/**/*.ts' --max-warnings 0",
-    "lint:md": "markdownlint-cli2 'pennyfarthing-dist/**/*.md'",
-    "validate:refs": "node scripts/validate-refs.js",
-    "test:validate-refs": "node --test scripts/validate-refs.test.js",
-    "clean": "pnpm -r clean"
-  },
   "dependencies": {
     "@pennyfarthing/shared": "^10.0.3",
     "chalk": "^5.3.0",
@@ -78,5 +65,16 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "packageManager": "pnpm@9.0.0"
-}
+  "scripts": {
+    "postinstall": "node scripts/postinstall.cjs",
+    "build": "pnpm --filter @pennyfarthing/shared build && pnpm --filter @pennyfarthing/core build && pnpm --filter @pennyfarthing/cyclist build && ./scripts/generate-skill-docs.sh",
+    "docs": "./scripts/generate-skill-docs.sh",
+    "dev": "pnpm -r --parallel dev",
+    "test": "pnpm -r test",
+    "lint": "eslint 'packages/*/src/**/*.ts' --max-warnings 0",
+    "lint:md": "markdownlint-cli2 'pennyfarthing-dist/**/*.md'",
+    "validate:refs": "node scripts/validate-refs.js",
+    "test:validate-refs": "node --test scripts/validate-refs.test.js",
+    "clean": "pnpm -r clean"
+  }
+}

package/pennyfarthing-dist/workflows/release/steps/step-10-publish.md

@@ -1,20 +1,29 @@
 # Step 10: Publish to npm
 
 <purpose>
-Publish all Pennyfarthing packages to the npm registry. Verifies authentication, checks for conflicts, publishes each package, and verifies registry state.
+Publish all Pennyfarthing packages to the npm registry. Uses `pnpm publish` to
+resolve `workspace:*` dependencies to real version numbers. Verifies authentication,
+checks for conflicts, publishes each package, and verifies registry state.
 </purpose>
 
+<critical>
+**MUST use `pnpm publish`** — not `npm publish`. Packages use `workspace:*` protocol
+for inter-package dependencies. `pnpm publish` resolves these to actual version numbers
+at publish time. `npm publish` does NOT — it publishes the literal `workspace:*` string,
+which breaks consumer installs.
+</critical>
+
 <instructions>
 1. Verify npm authentication
 2. Check that versions aren't already published
-3. Publish @pennyfarthing/core (root package)
-4. Publish @pennyfarthing/cyclist
-5. Publish all theme packs
-6. Verify published versions on registry
+3. Publish @pennyfarthing/core (root package) via pnpm
+4. Publish workspace packages via pnpm
+5. Verify published versions and resolved dependencies on registry
 </instructions>
 
 <output>
-npm publish results for each package, plus registry verification.
+pnpm publish results for each package, plus registry verification including
+dependency resolution check (no workspace:* in published metadata).
 </output>
 
 ## Execution
@@ -69,7 +78,7 @@ fi
 
 ```bash
 echo "Publishing @pennyfarthing/core@{new_version}..."
-npm publish --access public $NPM_TAG
+pnpm publish --access public --no-git-checks $NPM_TAG
 ```
 
 ### 10.5 Publish Workspace Packages
@@ -79,17 +88,20 @@ for pkg_dir in packages/cyclist packages/shared packages/themes-*; do
     if [[ -f "$pkg_dir/package.json" ]]; then
         PKG_NAME=$(node -e "console.log(require('./$pkg_dir/package.json').name)")
         echo "Publishing $PKG_NAME@{new_version}..."
-        (cd "$pkg_dir" && npm publish --access public $NPM_TAG) || echo "WARNING: Failed to publish $PKG_NAME"
+        (cd "$pkg_dir" && pnpm publish --access public --no-git-checks $NPM_TAG) || echo "WARNING: Failed to publish $PKG_NAME"
     fi
 done
 ```
 
-### 10.6 Verify Published
+### 10.6 Verify Published (including workspace:* resolution)
 
 ```bash
 echo "=== Registry Verification ==="
 echo "Waiting 10s for registry propagation..."
 sleep 10
+
+echo ""
+echo "=== Version Check ==="
 for PKG_JSON in package.json packages/*/package.json; do
     PKG_NAME=$(node -e "console.log(require('./$PKG_JSON').name)")
     npm view "$PKG_NAME@{new_version}" version 2>/dev/null \
@@ -97,6 +109,26 @@ for PKG_JSON in package.json packages/*/package.json; do
         || echo "  ✗ $PKG_NAME@{new_version} NOT FOUND"
 done
 
+echo ""
+echo "=== Dependency Resolution Check ==="
+echo "Verifying no workspace:* references leaked to npm..."
+LEAKED=0
+for PKG_JSON in package.json packages/*/package.json; do
+    PKG_NAME=$(node -e "console.log(require('./$PKG_JSON').name)")
+    DEPS=$(npm view "$PKG_NAME@{new_version}" dependencies --json 2>/dev/null || echo "{}")
+    if echo "$DEPS" | grep -q "workspace:"; then
+        echo "  ✗ $PKG_NAME has workspace: refs in published dependencies!"
+        echo "$DEPS" | grep "workspace:"
+        LEAKED=1
+    else
+        echo "  ✓ $PKG_NAME — no workspace: refs"
+    fi
+done
+if [[ $LEAKED -eq 1 ]]; then
+    echo ""
+    echo "ERROR: workspace:* references leaked to npm. Deprecate affected versions and re-publish."
+fi
+
 if [[ "$IS_PRERELEASE" == "true" ]]; then
     echo ""
     echo "=== Dist-Tag Verification ==="

package/scripts/README.md

@@ -1,41 +0,0 @@
-# Meta Scripts
-
-**These scripts are NOT distributed to users.** They are for Pennyfarthing framework development only.
-
-## Contents
-
-| Script | Purpose |
-|--------|---------|
-| `deploy.sh` | Release Pennyfarthing (version bump, tag, push, GitHub release) |
-| `cyclist-debug.mjs` | Debug Cyclist connection |
-| `handoff-cli.{sh,js}` | Test handoff flow |
-| `verify-visual-mapping.js` | Verify theme visual mappings |
-| `migrate-assets-to-slug.sh` | One-time migration script |
-| `resize-portraits.sh` | Resize portrait images |
-| `resolve-portrait.mjs` | Portrait resolution logic |
-| `validate-refs.js` | Validate internal references |
-
-> Benchmark scripts have been moved to `packages/benchmark/`.
-
-## Usage
-
-Run from pennyfarthing repo root:
-
-```bash
-# Release a new version
-./scripts/deploy.sh --dry-run patch
-./scripts/deploy.sh patch
-```
-
-## Where Should My Script Go?
-
-**Put it here if:**
-- It's for framework development/CI only
-- Users should NOT have access to it
-- It uses GPU/heavy dependencies (keep in meta, not distributed)
-
-**Put it in `pennyfarthing-dist/scripts/` if:**
-- Users need it for their workflows
-- It's part of the sprint/story/jira tooling
-
-See `CLAUDE.md` for the full decision tree.