@smoothbricks/cli 0.10.1 → 0.10.3

package/src/release/__tests__/trust-publisher.test.ts

@@ -3,8 +3,11 @@ import type { BootstrapNpmPackagesOptions } from '../bootstrap-npm-packages.js';
 import type { ReleasePackageInfo } from '../core.js';
 import {
   configureTrustedPublishers,
+  npmTrustGithubArgs,
+  npmTrustListAccessDenied,
   parseTrustedPublishers,
   type TrustedPublisher,
+  type TrustedPublisherLookup,
   type TrustPublisherShell,
 } from '../index.js';
 
@@ -101,6 +104,84 @@ describe('trusted publisher setup', () => {
     expect(shell.events).toEqual([`exists:${missing.name}`, `list:${missing.name}`, `trust:${missing.name}:false`]);
   });
 
+  it('reports package owners and opens npm login after trust access is denied', async () => {
+    const shell = new RecordingTrustPublisherShell({
+      packages: [stable],
+      existing: [stable.name],
+      trustedPublisherResponses: {
+        [stable.name]: [
+          {
+            status: 'access-denied',
+            identity: 'current-user',
+            owners: 'package-owner <owner@example.test>',
+          },
+          [],
+        ],
+      },
+    });
+
+    await configureTrustedPublishers(shell, {});
+
+    expect(shell.events).toEqual([
+      `exists:${stable.name}`,
+      `list:${stable.name}`,
+      'login',
+      `list:${stable.name}`,
+      `trust:${stable.name}:false`,
+    ]);
+    expect(shell.errors.join('\n')).toContain('npm account "current-user"');
+    expect(shell.errors.join('\n')).toContain('package-owner <owner@example.test>');
+    expect(shell.logs).toContain(
+      `${stable.name}: opening npm browser login. Sign in as a listed package owner, then return here.`,
+    );
+  });
+
+  it('stops after one owner login when the selected account still lacks access', async () => {
+    const shell = new RecordingTrustPublisherShell({
+      packages: [stable],
+      existing: [stable.name],
+      trustedPublisherResponses: {
+        [stable.name]: [
+          {
+            status: 'access-denied',
+            identity: 'current-user',
+            owners: 'package-owner <owner@example.test>',
+          },
+          {
+            status: 'access-denied',
+            identity: 'wrong-user',
+            owners: 'package-owner <owner@example.test>',
+          },
+        ],
+      },
+    });
+
+    await expect(configureTrustedPublishers(shell, {})).rejects.toThrow(
+      'npm browser login completed, but the selected account still cannot manage this package',
+    );
+    expect(shell.events).toEqual([`exists:${stable.name}`, `list:${stable.name}`, 'login', `list:${stable.name}`]);
+  });
+
+  it('grants the trusted workflow permission to run npm publish', () => {
+    expect(npmTrustGithubArgs(stable.name, 'scope/repo', 'publish.yml', false)).toEqual([
+      'trust',
+      'github',
+      stable.name,
+      '--file',
+      'publish.yml',
+      '--repo',
+      'scope/repo',
+      '--allow-publish',
+      '--yes',
+    ]);
+    expect(npmTrustGithubArgs(stable.name, 'scope/repo', 'publish.yml', true).at(-1)).toBe('--dry-run');
+  });
+
+  it('recognizes npm trust access-denied output', () => {
+    expect(npmTrustListAccessDenied('{"error":{"code":"E403"}}', '')).toBe(true);
+    expect(npmTrustListAccessDenied('', 'npm error code EOTP')).toBe(false);
+  });
+
   it('parses empty npm trust list output as no trusted publishers', () => {
     expect(parseTrustedPublishers('', stable.name)).toEqual([]);
     expect(parseTrustedPublishers('null', stable.name)).toEqual([]);
@@ -116,15 +197,18 @@ class RecordingTrustPublisherShell implements TrustPublisherShell<ReleasePackage
   private readonly packages: ReleasePackageInfo[];
   private readonly existing: Set<string>;
   private readonly trustedPublisherByPackage: Record<string, TrustedPublisher[]>;
+  private readonly trustedPublisherResponses: Record<string, TrustedPublisherLookup[]>;
 
   constructor(options: {
     packages: ReleasePackageInfo[];
     existing: string[];
     trustedPublishers?: Record<string, TrustedPublisher[]>;
+    trustedPublisherResponses?: Record<string, TrustedPublisherLookup[]>;
   }) {
     this.packages = options.packages;
     this.existing = new Set(options.existing);
     this.trustedPublisherByPackage = options.trustedPublishers ?? {};
+    this.trustedPublisherResponses = options.trustedPublisherResponses ?? {};
   }
 
   listReleasePackages(): ReleasePackageInfo[] {
@@ -145,14 +229,19 @@ class RecordingTrustPublisherShell implements TrustPublisherShell<ReleasePackage
     return missingPackages;
   }
 
+  async login(): Promise<void> {
+    this.events.push('login');
+  }
+
   async trustPublisher(pkg: ReleasePackageInfo, dryRun: boolean): Promise<'configured' | 'already-configured'> {
     this.events.push(`trust:${pkg.name}:${dryRun}`);
     return 'configured';
   }
 
-  async trustedPublishers(pkg: ReleasePackageInfo): Promise<TrustedPublisher[]> {
+  async trustedPublishers(pkg: ReleasePackageInfo): Promise<TrustedPublisherLookup> {
     this.events.push(`list:${pkg.name}`);
-    return this.trustedPublisherByPackage[pkg.name] ?? [];
+    const response = this.trustedPublisherResponses[pkg.name]?.shift();
+    return response ?? this.trustedPublisherByPackage[pkg.name] ?? [];
   }
 
   log(message: string): void {

package/src/release/github-release.ts

@@ -71,6 +71,7 @@ export function nxProjectChangelogArgs(pkg: ReleasePackageInfo, previousTag: str
     gitPush: false,
     stageChanges: false,
     createRelease: false,
+    forceChangelogGeneration: true,
     deleteVersionPlans: false,
     dryRun,
   } satisfies ChangelogOptions;
@@ -85,6 +86,17 @@ export function projectChangelogContents(result: ProjectChangelogLookupResult, p
   return changelog.contents;
 }
 
+export function githubReleaseLookupExists(tag: string, exitCode: number, stdout: string, stderr: string): boolean {
+  if (exitCode === 0) {
+    return true;
+  }
+  const details = [stderr.trim(), stdout.trim()].filter(Boolean).join('\n');
+  if (/\bHTTP 404\b|release not found/i.test(details)) {
+    return false;
+  }
+  throw new Error(`Unable to inspect GitHub Release ${tag}.${details ? `\n${details}` : ''}`);
+}
+
 export function githubReleaseCommandArgs(
   tag: string,
   notesFile: string,

package/src/release/index.ts

@@ -1,13 +1,14 @@
 import { appendFile, mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { join, resolve } from 'node:path';
 import { createInterface } from 'node:readline/promises';
 import { Writable } from 'node:stream';
 import { $ } from 'bun';
+import { githubCiApplyOutputs, githubCiNxRunMany } from '../github-ci/index.js';
 import { assertNoConflictMarkers } from '../lib/conflict-markers.js';
 import { withDevenvEnv } from '../lib/devenv.js';
 import { isRecord, readJsonObject, stringProperty } from '../lib/json.js';
-import { decode, run, runInteractiveStatus, runResult, runStatus } from '../lib/run.js';
+import { decode, run, runInteractiveStatus, runResult } from '../lib/run.js';
 import { listReleasePackages, readPackageJson, repositoryInfo } from '../lib/workspace.js';
 import { readPackedPackageJson, validatePackedWorkspaceDependencies } from '../monorepo/packed-manifest.js';
 import {
@@ -29,14 +30,18 @@ import {
 } from './core.js';
 import {
   createOrUpdateGithubRelease,
+  githubReleaseLookupExists,
   renderNxProjectChangelogContents,
   withNxWorkspaceRoot,
 } from './github-release.js';
 import { publishWithAuthDiagnostics } from './npm-auth.js';
 import {
   bumpStableReleaseToNext,
+  collectRepairPlatformOutputs,
   completeReleaseAtHead as completeReleaseAtHeadWithShell,
   type ReleaseCompletionShell,
+  type ReleaseRepairOutputsShell,
+  type ReleaseRepairShell,
   type ReleaseSummary,
   type ReleaseVersionMode,
   repairPendingTargets,
@@ -57,6 +62,15 @@ export interface ReleasePublishOptions {
 
 export interface ReleaseRepairPendingOptions {
   dryRun?: boolean;
+  platformOutputs?: string;
+  ref?: string;
+}
+
+export interface ReleasePlatformOutputsOptions {
+  bump: string;
+  output: string;
+  ref?: string;
+  targets: string;
 }
 
 export interface ReleaseTrustPublisherOptions {
@@ -162,26 +176,56 @@ export async function releasePublish(root: string, options: ReleasePublishOption
 }
 
 export async function releaseRepairPending(root: string, options: ReleaseRepairPendingOptions): Promise<void> {
-  const branch = await releaseBranch(root);
-  const remote = await releaseRemote(root, branch);
-  console.log(`Repair pending releases: fetching ${remote}/${branch} and tags.`);
-  await fetchReleaseRefs(root, remote, branch);
-  const remoteRef = `${remote}/${branch}`;
-  const restoreRef = (await gitRefExists(root, remoteRef)) ? remoteRef : await gitHead(root);
-  console.log(`Repair pending releases: planning from ${restoreRef}.`);
-  const targets = await listPendingReleaseTargets(root, restoreRef);
-  console.log(
-    targets.length === 0
-      ? 'Repair pending releases: no pending durable state repairs found.'
-      : `Repair pending releases: ${targets.length} release target${targets.length === 1 ? '' : 's'} need repair.`,
+  const repairRef = await fetchReleaseRepairRef(root, options.ref);
+  const restoreRef = options.ref ? await gitHead(root) : repairRef;
+  console.log(`Repair pending releases: planning from ${repairRef}.`);
+  const targets = await listPendingReleaseTargets(root, repairRef);
+  logPendingReleaseTargets(targets);
+  const platformOutputs = options.platformOutputs ? resolve(root, options.platformOutputs) : undefined;
+  const summaries = await repairPendingTargets(
+    releaseRepairShell(root, platformOutputs),
+    targets,
+    restoreRef,
+    options.dryRun === true,
   );
-  for (const target of targets) {
-    console.log(`Repair pending releases: target ${target.sha.slice(0, 12)} needs ${repairTargetSummary(target)}.`);
-  }
-  const summaries = await repairPendingTargets(releaseRepairShell(root), targets, restoreRef, options.dryRun === true);
   await writeRepairSummary(summaries, options.dryRun === true);
 }
 
+export async function releaseCollectPlatformOutputs(
+  root: string,
+  options: ReleasePlatformOutputsOptions,
+): Promise<void> {
+  const restoreRef = await gitHead(root);
+  const releaseRef = await fetchReleaseRepairRef(root, options.ref);
+  const packages = releasePackages(root);
+  const packagesAtHead = await releasePackagesAtHead(root, packages);
+  const currentPackages =
+    packagesAtHead.length > 0
+      ? packagesAtHead
+      : await releasePlatformPackages(root, packages, releaseBumpArg(options.bump));
+  console.log(
+    currentPackages.length === 0
+      ? 'Release platform outputs: no current release packages selected.'
+      : `Release platform outputs: building current outputs for ${packageSummary(currentPackages)}.`,
+  );
+  const outputRoot = resolve(root, options.output);
+  await githubCiNxRunMany(root, {
+    targets: options.targets,
+    projects: releasePackageProjects(currentPackages),
+    collectOutputs: join(outputRoot, 'current'),
+    allowEmptyProjects: true,
+  });
+
+  console.log(`Repair platform outputs: planning from ${releaseRef}.`);
+  const targets = await listPendingReleaseTargets(root, releaseRef);
+  logPendingReleaseTargets(targets);
+  await collectRepairPlatformOutputs(
+    releaseRepairOutputsShell(root, options.targets, join(outputRoot, 'repairs')),
+    targets,
+    restoreRef,
+  );
+}
+
 export async function releaseTrustPublisher(root: string, options: ReleaseTrustPublisherOptions): Promise<void> {
   const repository = githubRepositoryFromRootPackage(root);
   const workflow = 'publish.yml';
@@ -203,14 +247,10 @@ export async function releaseTrustPublisher(root: string, options: ReleaseTrustP
           },
           bootstrapOptions,
         ),
-      trustPublisher: (pkg, dryRun, env) => {
-        const args = ['trust', 'github', pkg.name, '--file', workflow, '--repo', repository, '--yes'];
-        if (dryRun) {
-          args.push('--dry-run');
-        }
-        return runLatestNpmTrust(root, args, env);
-      },
+      trustPublisher: (pkg, dryRun, env) =>
+        runLatestNpmTrust(root, npmTrustGithubArgs(pkg.name, repository, workflow, dryRun), env),
       trustedPublishers: (pkg) => listTrustedPublishers(root, pkg),
+      login: () => runLatestNpm(root, ['login', '--auth-type=web']),
       log: (message) => console.log(message),
       error: (message) => console.error(message),
     },
@@ -218,6 +258,19 @@ export async function releaseTrustPublisher(root: string, options: ReleaseTrustP
   );
 }
 
+export function npmTrustGithubArgs(
+  packageName: string,
+  repository: string,
+  workflow: string,
+  dryRun: boolean,
+): string[] {
+  const args = ['trust', 'github', packageName, '--file', workflow, '--repo', repository, '--allow-publish', '--yes'];
+  if (dryRun) {
+    args.push('--dry-run');
+  }
+  return args;
+}
+
 export interface TrustPublisherShell<Package extends ReleasePackageInfo = ReleasePackageInfo> {
   repository: string;
   workflow: string;
@@ -225,7 +278,8 @@ export interface TrustPublisherShell<Package extends ReleasePackageInfo = Releas
   packageExists(name: string): Promise<boolean>;
   bootstrapNpmPackages(options: BootstrapNpmPackagesOptions): Promise<Package[]>;
   trustPublisher(pkg: Package, dryRun: boolean, env?: Record<string, string>): Promise<TrustPublisherResult>;
-  trustedPublishers(pkg: Package): Promise<TrustedPublisher[]>;
+  trustedPublishers(pkg: Package): Promise<TrustedPublisherLookup>;
+  login(): Promise<void>;
   log(message: string): void;
   error(message: string): void;
 }
@@ -239,6 +293,14 @@ export interface TrustedPublisher {
   repository?: string;
 }
 
+export interface NpmTrustAccessDenied {
+  readonly status: 'access-denied';
+  readonly identity: string;
+  readonly owners: string;
+}
+
+export type TrustedPublisherLookup = TrustedPublisher[] | NpmTrustAccessDenied;
+
 export async function configureTrustedPublishers<Package extends ReleasePackageInfo>(
   shell: TrustPublisherShell<Package>,
   options: ReleaseTrustPublisherOptions,
@@ -275,7 +337,7 @@ export async function configureTrustedPublishers<Package extends ReleasePackageI
   const failedPackages: string[] = [];
   for (const pkg of selectedPackages) {
     if (!options.dryRun) {
-      const trustedPublishers = await shell.trustedPublishers(pkg);
+      const trustedPublishers = await trustedPublishersWithOwnerLogin(shell, pkg);
       if (hasMatchingGithubTrustedPublisher(trustedPublishers, shell.repository, shell.workflow)) {
         shell.log(`${pkg.name}: npm trusted publisher is already configured; skipping.`);
         continue;
@@ -315,6 +377,33 @@ export async function configureTrustedPublishers<Package extends ReleasePackageI
   }
 }
 
+async function trustedPublishersWithOwnerLogin<Package extends ReleasePackageInfo>(
+  shell: TrustPublisherShell<Package>,
+  pkg: Package,
+): Promise<TrustedPublisher[]> {
+  let result = await shell.trustedPublishers(pkg);
+  if (Array.isArray(result)) {
+    return result;
+  }
+
+  shell.error(
+    `${pkg.name}: npm trust access denied for npm account "${result.identity}". ` +
+      `npm trust requires package write access. Package owners:\n${result.owners}`,
+  );
+  shell.log(`${pkg.name}: opening npm browser login. Sign in as a listed package owner, then return here.`);
+  await shell.login();
+
+  result = await shell.trustedPublishers(pkg);
+  if (Array.isArray(result)) {
+    return result;
+  }
+  throw new Error(
+    `${pkg.name}: npm trust access denied for npm account "${result.identity}". ` +
+      `npm trust requires package write access. Package owners:\n${result.owners}\n` +
+      'npm browser login completed, but the selected account still cannot manage this package.',
+  );
+}
+
 function selectedTrustPublisherPackages<Package extends ReleasePackageInfo>(
   packages: Package[],
   selections: string[],
@@ -548,6 +637,19 @@ async function releaseVersionPackages(
   );
 }
 
+async function releasePlatformPackages(
+  root: string,
+  packages: ReleasePackage[],
+  bump: string,
+): Promise<ReleasePackage[]> {
+  const candidates = await releaseVersionPackages(root, packages, bump);
+  if (candidates.length === 0) {
+    return [];
+  }
+  // Nx may version additional reverse dependents, so use its dry-run result rather than only the direct candidates.
+  return runNxReleaseVersionPreview(root, releasePackageProjects(candidates), bump);
+}
+
 async function runNxReleaseVersion(
   root: string,
   projects: string,
@@ -603,6 +705,7 @@ async function runNxReleaseVersionPreview(root: string, projects: string, bump:
       gitPush: false,
       stageChanges: false,
       createRelease: false,
+      forceChangelogGeneration: true,
       dryRun: true,
     });
     releasePreviewChangelogs.clear();
@@ -808,17 +911,11 @@ function releaseNextShell(root: string): { bumpStablePackagesToNext(packages: Re
   };
 }
 
-function releaseRepairShell(root: string): ReleaseCompletionShell<ReleasePackage> & {
-  checkout(ref: string): Promise<void>;
-  withDevenvEnv<T>(runWithEnv: () => Promise<T>): Promise<T>;
-  beforeRepairTarget(target: ReleaseTarget): void;
-  afterRepairTarget(target: ReleaseTarget): void;
-} {
+function releaseTargetCheckoutShell(root: string) {
   return {
-    ...releaseCompletionShell(root),
-    checkout: (ref) => run('git', ['switch', '--detach', ref], root),
-    withDevenvEnv: (runWithEnv) => withDevenvEnv(root, runWithEnv),
-    beforeRepairTarget: (target) => {
+    checkout: (ref: string) => run('git', ['switch', '--detach', ref], root),
+    withDevenvEnv: <T>(runWithEnv: () => Promise<T>) => withDevenvEnv(root, runWithEnv),
+    beforeRepairTarget: (target: ReleaseTarget) => {
       console.log(`::group::Repair pending release ${target.sha.slice(0, 12)} (${packageSummary(target.packages)})`);
     },
     afterRepairTarget: () => {
@@ -827,6 +924,37 @@ function releaseRepairShell(root: string): ReleaseCompletionShell<ReleasePackage
   };
 }
 
+function releaseRepairShell(root: string, platformOutputs?: string): ReleaseRepairShell<ReleasePackage> {
+  return {
+    ...releaseCompletionShell(root),
+    ...releaseTargetCheckoutShell(root),
+    prepareRepairTarget: async (target) => {
+      if (!platformOutputs || target.npmPackages.length === 0) {
+        return;
+      }
+      const output = join(platformOutputs, target.sha);
+      console.log(`Repair pending releases: applying cross-platform outputs from ${output}.`);
+      await githubCiApplyOutputs(root, [output], target.sha);
+    },
+  };
+}
+
+function releaseRepairOutputsShell(
+  root: string,
+  targetGlobs: string,
+  outputRoot: string,
+): ReleaseRepairOutputsShell<ReleasePackage> {
+  return {
+    ...releaseTargetCheckoutShell(root),
+    collectRepairTargetOutputs: (target) =>
+      githubCiNxRunMany(root, {
+        targets: targetGlobs,
+        projects: releasePackageProjects(target.npmPackages),
+        collectOutputs: join(outputRoot, target.sha),
+      }),
+  };
+}
+
 function releaseRetagShell(root: string, remote: string) {
   return {
     listReleasePackages: () => releasePackages(root),
@@ -844,6 +972,29 @@ function releaseRetagShell(root: string, remote: string) {
   };
 }
 
+async function fetchReleaseRepairRef(root: string, requestedRef?: string): Promise<string> {
+  const branch = await releaseBranch(root);
+  const remote = await releaseRemote(root, branch);
+  console.log(`Repair pending releases: fetching ${remote}/${branch} and tags.`);
+  await fetchReleaseRefs(root, remote, branch);
+  if (requestedRef) {
+    return requestedRef;
+  }
+  const remoteRef = `${remote}/${branch}`;
+  return (await gitRefExists(root, remoteRef)) ? remoteRef : gitHead(root);
+}
+
+function logPendingReleaseTargets(targets: ReleaseTarget[]): void {
+  console.log(
+    targets.length === 0
+      ? 'Repair pending releases: no pending durable state repairs found.'
+      : `Repair pending releases: ${targets.length} release target${targets.length === 1 ? '' : 's'} need repair.`,
+  );
+  for (const target of targets) {
+    console.log(`Repair pending releases: target ${target.sha.slice(0, 12)} needs ${repairTargetSummary(target)}.`);
+  }
+}
+
 async function listPendingReleaseTargets(root: string, ref: string): Promise<ReleaseTarget[]> {
   const head = await gitHead(root);
   return pendingReleaseTargets(await listOwnedReleaseTagRecords(root, ref), head);
@@ -1069,7 +1220,8 @@ function repairReasons(target: ReleaseTarget, pkg: ReleasePackage): string[] {
 }
 
 async function fetchReleaseRefs(root: string, remote: string, branch: string): Promise<void> {
-  await run('git', ['fetch', '--tags', remote, branch], root);
+  // `retag-unpublished` intentionally moves repairable tags, so the remote tag is authoritative.
+  await run('git', ['fetch', '--force', '--tags', remote, branch], root);
 }
 
 async function gitRefExists(root: string, ref: string): Promise<boolean> {
@@ -1309,7 +1461,8 @@ async function pushRetaggedReleaseTags(
 }
 
 async function githubReleaseExists(root: string, tag: string): Promise<boolean> {
-  return (await runStatus('gh', ['release', 'view', tag, '--json', 'tagName'], root, true)) === 0;
+  const result = await $`gh release view ${tag} --json tagName`.cwd(root).quiet().nothrow();
+  return githubReleaseLookupExists(tag, result.exitCode, decode(result.stdout), decode(result.stderr));
 }
 
 function githubReleaseUrl(root: string, tag: string): string {
@@ -1465,7 +1618,7 @@ async function runLatestNpmTrust(
   throw new Error(`nix shell nixpkgs#nodejs_latest -c npm ${npmArgs.join(' ')} failed with exit code ${status}`);
 }
 
-async function listTrustedPublishers(root: string, pkg: Pick<ReleasePackage, 'name'>): Promise<TrustedPublisher[]> {
+async function listTrustedPublishers(root: string, pkg: Pick<ReleasePackage, 'name'>): Promise<TrustedPublisherLookup> {
   const args = ['trust', 'list', pkg.name, '--json'];
   let result = await runResult('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...args], root);
   if (result.exitCode !== 0 && /\bEOTP\b/.test(`${result.stdout}\n${result.stderr}`)) {
@@ -1475,6 +1628,9 @@ async function listTrustedPublishers(root: string, pkg: Pick<ReleasePackage, 'na
     }
     result = await runResult('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...args], root);
   }
+  if (result.exitCode !== 0 && npmTrustListAccessDenied(result.stdout, result.stderr)) {
+    return npmTrustAccessDetails(root, pkg.name);
+  }
   if (result.exitCode !== 0) {
     throw new Error(
       `nix shell nixpkgs#nodejs_latest -c npm ${args.join(' ')} failed with exit code ${result.exitCode}`,
@@ -1483,6 +1639,28 @@ async function listTrustedPublishers(root: string, pkg: Pick<ReleasePackage, 'na
   return parseTrustedPublishers(result.stdout, pkg.name);
 }
 
+export function npmTrustListAccessDenied(stdout: string, stderr: string): boolean {
+  return /\bE403\b/.test(`${stdout}\n${stderr}`);
+}
+
+async function npmTrustAccessDetails(root: string, packageName: string): Promise<NpmTrustAccessDenied> {
+  const [identityResult, ownersResult] = await Promise.all([
+    runResult('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', 'whoami'], root),
+    runResult('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', 'owner', 'ls', packageName], root),
+  ]);
+  return {
+    status: 'access-denied',
+    identity:
+      identityResult.exitCode === 0 && identityResult.stdout.trim().length > 0
+        ? identityResult.stdout.trim()
+        : '(not authenticated)',
+    owners:
+      ownersResult.exitCode === 0 && ownersResult.stdout.trim().length > 0
+        ? ownersResult.stdout.trim()
+        : '(owner lookup unavailable)',
+  };
+}
+
 export function parseTrustedPublishers(stdout: string, packageName: string): TrustedPublisher[] {
   if (stdout.trim().length === 0) {
     return [];

package/src/release/orchestration.ts

@@ -30,14 +30,24 @@ export interface ReleaseNextShell<Package extends ReleasePackageInfo = ReleasePa
   bumpStablePackagesToNext(packages: Package[]): Promise<void>;
 }
 
-export interface ReleaseRepairShell<Package extends ReleasePackageInfo = ReleasePackageInfo>
-  extends ReleaseCompletionShell<Package> {
+export interface ReleaseTargetCheckoutShell<Package extends ReleasePackageInfo = ReleasePackageInfo> {
   checkout(ref: string): Promise<void>;
   withDevenvEnv<T>(runWithEnv: () => Promise<T>): Promise<T>;
   beforeRepairTarget?(target: ReleaseTarget<Package>): void;
   afterRepairTarget?(target: ReleaseTarget<Package>): void;
 }
 
+export interface ReleaseRepairShell<Package extends ReleasePackageInfo = ReleasePackageInfo>
+  extends ReleaseCompletionShell<Package>,
+    ReleaseTargetCheckoutShell<Package> {
+  prepareRepairTarget?(target: ReleaseTarget<Package>): Promise<void>;
+}
+
+export interface ReleaseRepairOutputsShell<Package extends ReleasePackageInfo = ReleasePackageInfo>
+  extends ReleaseTargetCheckoutShell<Package> {
+  collectRepairTargetOutputs(target: ReleaseTarget<Package>): Promise<void>;
+}
+
 export interface ReleaseVersionShell<Package extends ReleasePackageInfo = ReleasePackageInfo> {
   releasePackagesAtHead(): Promise<Package[]>;
   releaseVersionPackages(bump: string): Promise<Package[]>;
@@ -151,17 +161,59 @@ export async function repairPendingTargets<Package extends ReleasePackageInfo>(
       }
       shell.beforeRepairTarget?.(target);
       try {
-        summaries.push(await shell.withDevenvEnv(() => completeRepairTargetAtHead(shell, target, dryRun)));
+        summaries.push(
+          await shell.withDevenvEnv(async () => {
+            await shell.prepareRepairTarget?.(target);
+            return completeRepairTargetAtHead(shell, target, dryRun);
+          }),
+        );
       } finally {
         shell.afterRepairTarget?.(target);
       }
     }
   } finally {
     await shell.checkout(restoreRef);
+    if (targets.length > 0) {
+      // Loading devenv at a historical release can rebuild ignored tool outputs
+      // from that checkout. Refresh after restoring HEAD so later release phases
+      // cannot combine the current CLI with an older Nx plugin build.
+      await shell.withDevenvEnv(async () => undefined);
+    }
   }
   return summaries;
 }
 
+export async function collectRepairPlatformOutputs<Package extends ReleasePackageInfo>(
+  shell: ReleaseRepairOutputsShell<Package>,
+  targets: Array<ReleaseTarget<Package>>,
+  restoreRef: string,
+): Promise<void> {
+  const outputTargets = targets.filter((target) => target.npmPackages.length > 0);
+  if (outputTargets.length === 0) {
+    return;
+  }
+  try {
+    for (const target of outputTargets) {
+      await shell.checkout(target.sha);
+      if (target.packages.length === 0) {
+        // invariant throw: release target discovery must never yield a package-free target.
+        throw new Error(`Release commit ${target.sha} has no release packages after checkout.`);
+      }
+      shell.beforeRepairTarget?.(target);
+      try {
+        await shell.withDevenvEnv(() => shell.collectRepairTargetOutputs(target));
+      } finally {
+        shell.afterRepairTarget?.(target);
+      }
+    }
+  } finally {
+    await shell.checkout(restoreRef);
+    // Historical devenv activation may rebuild ignored tool outputs. Restore the
+    // dispatch environment before the macOS job performs any further work.
+    await shell.withDevenvEnv(async () => undefined);
+  }
+}
+
 function repairDryRunSummary<Package extends ReleasePackageInfo>(
   target: ReleaseTarget<Package>,
 ): ReleaseSummary<Package> {