agenticreplay 0.1.0 → 0.1.2

package/scripts/render-demo.mjs

@@ -1,139 +0,0 @@
-#!/usr/bin/env node
-/**
- * Render the README's hero animation.
- *
- * The lines below are real output, copied from `docs/media/transcript.txt` — a single recorded
- * session captured with NO_COLOR=1. They are trimmed for width and nothing else; no line is
- * invented or reworded. The README's previous hero was hand-written prose that no code produced,
- * which is exactly the kind of thing a debugger cannot afford to ship.
- *
- * A GIF rather than an animated SVG because GitHub, X and HN all render a GIF the same way, and a
- * README that only animates in some places is worse than one that animates nowhere.
- *
- * Optional tooling, deliberately not in package.json so `npm ci` stays lean for everyone who is
- * not regenerating README art:
- *
- *   npm i --no-save playwright-core pngjs gifenc
- *   node scripts/render-demo.mjs            # -> docs/demo-cli.gif
- *
- * The viewer GIF (docs/demo-viewer.gif) is captured the same way, by driving `agenticreplay ui` in the same
- * browser; see docs/media/README.md.
- */
-import { chromium } from 'playwright-core';
-import { mkdtempSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { PNG } from 'pngjs';
-import gifenc from 'gifenc';
-
-const { GIFEncoder, quantize, applyPalette } = gifenc;
-const REPO = join(dirname(fileURLToPath(import.meta.url)), '..');
-const TARGET = join(REPO, 'docs', 'demo-cli.gif');
-const FRAMES = mkdtempSync(join(tmpdir(), 'agenticreplay-demo-'));
-
-/** Every line is from docs/media/transcript.txt, trimmed for width and not otherwise altered. */
-const SCRIPT = [
-  ['cmd', '$ agenticreplay record claude -- -p "Reject tokens shorter than 8 chars in auth.ts"'],
-  ['dim', 'info recording run=run_c00c6c89 adapter=claude-code proxy=:44043 fs=on shell=on'],
-  ['out', 'Updated `isValid` in auth.ts to require tokens of at least 8 characters.'],
-  ['dim', 'info recorded run=run_c00c6c89 events=42 blobs=8 exit=0'],
-  ['gap', ''],
-  ['cmd', '$ agenticreplay replay last'],
-  ['dim', 'info replay.restored to=5c1e02c6 your_tree=fbb98ae5  # put back when the replay ends'],
-  ['dim', 'info replaying exchanges=6 egress=blocked cwd=/tmp/herodemo'],
-  ['warn', 'warn divergence seq=5 level=major  request 1 has an identical trailing message'],
-  ['ok', 'info replay.done matched=2 total=6 divergences=4 unmatched=0 exit=0'],
-  ['gap', ''],
-  ['cmd', '$ agenticreplay compare last --from 4 --models claude-sonnet-5,claude-haiku-4-5 \\'],
-  ['cmd', '      --verify "npx tsc --noEmit auth.ts"'],
-  ['dim', 'info forked from=run_c00c6c89 at=4 model=claude-sonnet-5'],
-  ['dim', 'info forked from=run_c00c6c89 at=4 model=claude-haiku-4-5'],
-  ['gap', ''],
-  ['head', 'MODEL                      VERDICT  TOKENS   COST       WALL'],
-  ['row', 'claude-sonnet-5            pass     124/429  $0.006807  12.2s'],
-  ['row', 'claude-haiku-4-5-20251001  pass     184/650  $0.003434  14.3s'],
-  ['gap', ''],
-  ['note', 'same task · same files · same prefix — the model is the only variable'],
-];
-
-const CSS = `
-  :root { --ground:#08090A; --ink:#E8ECEC; --dim:#6B7578; --ok:#C6D6DA; --row:#9AA4A7; }
-  * { box-sizing: border-box; }
-  body { margin:0; background:var(--ground); color:var(--ink);
-         font: 13px/1.62 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; }
-  .chrome { display:flex; align-items:center; gap:.6rem; padding:.7rem 1.1rem;
-            border-bottom:1px solid #1F2426; color:var(--dim); font-size:10.5px; letter-spacing:.14em; }
-  .dot { width:9px; height:9px; border-radius:50%; background:#1F2426; }
-  .body { padding:.9rem 1.1rem; white-space:pre; }
-  .l { opacity:0; }
-  .l.on { opacity:1; }
-  .cmd  { color:var(--ink); font-weight:600; }
-  .dim, .head { color:var(--dim); }
-  .out  { color:var(--row); }
-  .warn { color:var(--row); }
-  .ok   { color:var(--ok); }
-  .row  { color:var(--ink); }
-  .note { color:var(--dim); font-style:italic; }
-  .gap  { height:.5rem; }
-  .cur  { display:inline-block; width:7px; height:14px; background:var(--ink);
-          vertical-align:-2px; margin-left:2px; }
-`;
-
-const html = `<!doctype html><meta charset="utf-8"><style>${CSS}</style>
-<div class="chrome"><span class="dot"></span><span class="dot"></span><span class="dot"></span>
-<span style="margin-left:.4rem">AGENTICREPLAY — RECORD · REPLAY · FORK</span></div>
-<div class="body">${SCRIPT.map(
-  ([k, t], i) =>
-    `<div class="l ${k}" id="l${i}">${t.replace(/&/g, '&amp;').replace(/</g, '&lt;') || '&nbsp;'}</div>`,
-).join('')}</div>`;
-
-const browser = await chromium.launch({
-  executablePath: '/opt/pw-browsers/chromium-1194/chrome-linux/chrome',
-});
-const page = await browser.newPage({ viewport: { width: 900, height: 520 }, deviceScaleFactor: 1 });
-await page.setContent(html);
-
-// One frame per state change, with the hold expressed as that frame's delay. 107 near-identical
-// PNGs made a 5.5 MB GIF; 22 frames carrying their own timing say exactly the same thing.
-const HOLD_MS = SCRIPT.map(([k]) =>
-  k === 'cmd' ? 620 : k === 'gap' ? 220 : k === 'row' ? 700 : k === 'note' ? 900 : 460,
-);
-let frame = 0;
-const delays = [];
-const snap = async (ms) => {
-  await page.screenshot({ path: `${FRAMES}/f${String(frame++).padStart(4, '0')}.png` });
-  delays.push(ms);
-};
-
-await snap(500);
-for (let i = 0; i < SCRIPT.length; i += 1) {
-  await page.evaluate((n) => document.getElementById(`l${n}`)?.classList.add('on'), i);
-  await snap(HOLD_MS[i]);
-}
-delays[delays.length - 1] = 3200; // let the table sit before it loops
-await browser.close();
-
-// Encode in-process. The ffmpeg that ships with Playwright is stripped to what Playwright needs —
-// no PNG decoder, no GIF muxer — so shelling out to it silently fails on both ends.
-const files = readdirSync(FRAMES)
-  .filter((f) => f.endsWith('.png'))
-  .sort();
-const enc = GIFEncoder();
-// One palette for the whole clip, built from the final frame: it carries every colour the sequence
-// ever shows, so nothing shifts hue partway through.
-const last = PNG.sync.read(readFileSync(join(FRAMES, files[files.length - 1])));
-const palette = quantize(new Uint8ClampedArray(last.data), 32, { format: 'rgb565' });
-for (const [i, f] of files.entries()) {
-  const png = PNG.sync.read(readFileSync(join(FRAMES, f)));
-  const indexed = applyPalette(new Uint8ClampedArray(png.data), palette, 'rgb565');
-  enc.writeFrame(indexed, png.width, png.height, {
-    palette: i === 0 ? palette : undefined,
-    delay: delays[i] ?? 500,
-    repeat: 0,
-  });
-}
-enc.finish();
-const bytes = Buffer.from(enc.bytes());
-writeFileSync(TARGET, bytes);
-console.log(`${TARGET}: ${files.length} frames, ${(bytes.length / 1024).toFixed(0)} KB`);

package/scripts/render-sync-card.mjs

@@ -1,96 +0,0 @@
-#!/usr/bin/env node
-/**
- * Render the README's push/pull card.
- *
- * EVERY LINE BELOW IS REAL OUTPUT, read from docs/media/sync-transcript.txt rather than typed
- * here. That transcript is a genuine round trip: `agenticreplay record` against the repo's own fake agent,
- * then `agenticreplay push`, then `agenticreplay pull` into a DIFFERENT workspace, then `agenticreplay show` reading the
- * pulled copy — captured with NO_COLOR=1. Nothing is reworded and no line is invented.
- *
- * The same rule render-demo.mjs states for the hero animation, and for the same reason: a README
- * that illustrates a debugger with output no code produced is advertising the one failure the tool
- * exists to prevent. The gateway in the transcript is a local stub speaking the OrcaRouter upload
- * and export contract (POST /api/replay/runs, GET /api/replay/runs/:key/export), so the URL in the
- * `gateway=` field is a loopback address and is left exactly as the command printed it.
- *
- * Optional tooling, deliberately not in package.json so `npm ci` stays lean for everyone who is
- * not regenerating README art:
- *
- *   npm i --no-save playwright-core
- *   node scripts/render-sync-card.mjs        # -> docs/sync-card.png
- */
-import { chromium } from 'playwright-core';
-import { readFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const REPO = join(dirname(fileURLToPath(import.meta.url)), '..');
-const SOURCE = join(REPO, 'docs', 'media', 'sync-transcript.txt');
-const TARGET = join(REPO, 'docs', 'sync-card.png');
-
-/**
- * Classify a real transcript line for styling only. The text is never altered — if a line does not
- * match a known shape it is rendered as plain output rather than dropped, so a transcript this
- * script does not fully understand still renders in full.
- */
-function classify(line) {
-  if (line.startsWith('$ ')) return 'cmd';
-  if (line.startsWith('error')) return 'err';
-  if (/^info (push|pull)\.done/.test(line)) return 'ok';
-  if (line.startsWith('info ')) return 'dim';
-  if (/^SEQ\s+KIND/.test(line)) return 'head';
-  if (/^\d+\s+\w+/.test(line)) return 'row';
-  if (line.trim() === '') return 'gap';
-  return 'out';
-}
-
-const lines = readFileSync(SOURCE, 'utf8').replace(/\n+$/, '').split('\n');
-
-const CSS = `
-  :root { --ground:#08090A; --ink:#E8ECEC; --dim:#6B7578; --ok:#C6D6DA; --row:#9AA4A7; }
-  * { box-sizing: border-box; }
-  body { margin:0; background:var(--ground); color:var(--ink);
-         font: 13px/1.62 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; }
-  .chrome { display:flex; align-items:center; gap:.6rem; padding:.7rem 1.1rem;
-            border-bottom:1px solid #1F2426; color:var(--dim); font-size:10.5px; letter-spacing:.14em; }
-  .dot { width:9px; height:9px; border-radius:50%; background:#1F2426; }
-  .body { padding:.9rem 1.1rem; white-space:pre; }
-  .cmd  { color:var(--ink); font-weight:600; }
-  .dim, .head { color:var(--dim); }
-  .out  { color:var(--row); }
-  .err  { color:var(--row); }
-  .ok   { color:var(--ok); }
-  .row  { color:var(--ink); }
-  .gap  { height:.5rem; }
-`;
-
-const html = `<!doctype html><meta charset="utf-8"><style>${CSS}</style>
-<div class="chrome"><span class="dot"></span><span class="dot"></span><span class="dot"></span>
-<span>AGENTICREPLAY · PUSH AND PULL</span></div>
-<div class="body">${lines
-  .map((l) => {
-    const kind = classify(l);
-    const text = l.replace(/[&<>]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;' })[c]);
-    return kind === 'gap' ? `<div class="gap"></div>` : `<div class="${kind}">${text}</div>`;
-  })
-  .join('')}</div>`;
-
-const browser = await chromium.launch({
-  executablePath: process.env.CHROMIUM_PATH ?? '/opt/pw-browsers/chromium-1194/chrome-linux/chrome',
-});
-const page = await browser.newPage({ viewport: { width: 960, height: 600 }, deviceScaleFactor: 2 });
-await page.setContent(html);
-
-// SIZED TO THE OUTPUT, rather than the output trimmed to fit a fixed card. `agenticreplay show`'s DETAIL
-// column is as wide as the tool call it is reporting, and a card that clipped it would be showing
-// an abbreviation of real output while presenting itself as a transcript. Measured from the
-// rendered text, so the width follows whatever the commands actually printed.
-const width = await page.evaluate(
-  () => Math.ceil(document.querySelector('.body').scrollWidth) + 36,
-);
-await page.setViewportSize({ width: Math.max(960, width), height: 600 });
-const height = await page.evaluate(() => Math.ceil(document.body.scrollHeight));
-await page.setViewportSize({ width: Math.max(960, width), height });
-await page.screenshot({ path: TARGET });
-await browser.close();
-console.log(`wrote ${TARGET} (${lines.length} real transcript lines)`);

package/scripts/set-version.mjs

@@ -1,152 +0,0 @@
-#!/usr/bin/env node
-/**
- * Set one version across every workspace, and rewrite the internal pins that name it.
- *
- * Twelve packages depend on each other by *exact* version — `"@agenticreplay/core": "0.2.3"`, never a
- * range — for the reason `publish-order.mjs` gives: a range resolves to whatever is latest, so a
- * 0.1.0 CLI would install a 0.9.0 core. The cost is that a version bump is not one edit but
- * thirteen manifests plus every pin inside them, and `npm version --workspaces` does not touch the
- * pins: it moves each package's own `version` and leaves its dependents naming the old one, which
- * `publish-order.mjs` then rejects. Every release so far was therefore a hand-written commit
- * touching thirteen files, which is exactly the kind of thing that goes wrong once and is
- * irreversible on npm.
- *
- *     node scripts/set-version.mjs 0.2.4            # manifests only
- *     node scripts/set-version.mjs 0.2.4 --lock     # and reconcile package-lock.json
- *     node scripts/set-version.mjs 0.2.4 --check    # say what would change, write nothing
- *
- * `--lock` is what a bump you intend to *commit* needs, because `npm ci` fails on a lockfile that
- * disagrees with the manifests. A publish does not read the lockfile, so the release workflows that
- * set a version in the runner and never commit it can skip the slow half.
- *
- * Verified by `scripts/set-version.test.ts`, and by `publish-order.mjs`, which every release runs
- * and which fails loudly if a pin was left behind.
- */
-import { execFileSync } from 'node:child_process';
-import { readdir, readFile, writeFile } from 'node:fs/promises';
-import { join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const root = fileURLToPath(new URL('..', import.meta.url));
-
-/**
- * Accepts a prerelease, because that is what the `next` channel publishes — but only a *legal* one.
- *
- * `0.2.4-main.g90fc463` is a legal semver version and npm treats it specially: it is excluded from
- * `npm install <pkg>` even though it sorts above `0.2.3`, so a prerelease cannot reach someone who
- * did not ask for it by name.
- *
- * This is semver.org's own grammar rather than a loose `[0-9A-Za-z.-]+`, because the loose form
- * accepts something npm will not publish as written and does not refuse either. A numeric
- * prerelease identifier may not have a leading zero, so `0.2.4-main.0123456` is invalid — and
- * `npm publish` does not fail on it. It runs the manifest through `@npmcli/package-json`'s `fix()`,
- * which *rewrites* the version to `0.2.4-main.123456` with only a warning, and leaves every
- * dependency pin naming `0.2.4-main.0123456`. Measured with npm's own library:
- *
- *     fix() version : 0.2.4-main.123456
- *     fix() dep pin : 0.2.4-main.0123456
- *
- * Twelve packages would go out at one version while declaring dependencies on another that does not
- * exist, and npm never lets a version be replaced. The `next` channel would be permanently
- * unresolvable. A short sha triggers it whenever its first seven characters are all digits and
- * start with a zero — about one commit in 270.
- *
- * Build metadata (`+…`) is left out of the grammar on purpose rather than allowed: npm ignores it
- * when comparing versions, so two different trees could claim the same version to the registry.
- */
-const VERSION =
-  /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?$/;
-
-const DEP_FIELDS = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'];
-
-/** Every workspace manifest, plus the root, which carries a version of its own. */
-async function manifests() {
-  const found = [join(root, 'package.json')];
-  const dir = join(root, 'packages');
-  for (const entry of await readdir(dir, { withFileTypes: true })) {
-    if (!entry.isDirectory()) continue;
-    found.push(join(dir, entry.name, 'package.json'));
-  }
-  return found;
-}
-
-/** The names this repository publishes, so a pin on someone else's package is left alone. */
-async function internalNames(paths) {
-  const names = new Set();
-  for (const path of paths) {
-    const pkg = JSON.parse(await readFile(path, 'utf8').catch(() => '{}'));
-    if (typeof pkg.name === 'string' && pkg.name.startsWith('@agenticreplay/')) names.add(pkg.name);
-  }
-  return names;
-}
-
-async function main() {
-  const args = process.argv.slice(2);
-  const version = args.find((a) => !a.startsWith('--'));
-  const check = args.includes('--check');
-  const lock = args.includes('--lock');
-
-  if (version === undefined) {
-    console.error('usage: node scripts/set-version.mjs <version> [--lock] [--check]');
-    process.exit(2);
-  }
-  if (!VERSION.test(version)) {
-    console.error(
-      `"${version}" is not a version this can set — expected 1.2.3 or 1.2.3-main.abc1234`,
-    );
-    process.exit(2);
-  }
-
-  const paths = await manifests();
-  const internal = await internalNames(paths);
-  const changes = [];
-
-  for (const path of paths) {
-    const before = await readFile(path, 'utf8');
-    const pkg = JSON.parse(before);
-    const label = pkg.name ?? path;
-
-    if (pkg.version !== undefined && pkg.version !== version) {
-      changes.push(`${label}: version ${pkg.version} -> ${version}`);
-      pkg.version = version;
-    }
-    for (const field of DEP_FIELDS) {
-      const deps = pkg[field];
-      if (deps === undefined) continue;
-      for (const name of Object.keys(deps)) {
-        // Only what this repository publishes, and only a pin that has actually moved. A
-        // `workspace:` protocol or a range would be a bug `publish-order.mjs` reports, so it is
-        // replaced here too rather than quietly preserved.
-        if (!internal.has(name) || deps[name] === version) continue;
-        changes.push(`${label}: ${field}.${name} ${deps[name]} -> ${version}`);
-        deps[name] = version;
-      }
-    }
-
-    // Re-serialised with the trailing newline npm itself writes, so a bump is a diff of the lines
-    // that changed rather than of the whole file.
-    const after = `${JSON.stringify(pkg, null, 2)}\n`;
-    if (after !== before && !check) await writeFile(path, after);
-  }
-
-  if (changes.length === 0) {
-    console.log(`already at ${version} — nothing to change`);
-  } else {
-    for (const line of changes) console.log(`  ${line}`);
-    console.log(`${check ? 'would change' : 'changed'} ${changes.length} field(s) to ${version}`);
-  }
-
-  if (lock && !check) {
-    // `npm ci` fails on a lockfile that disagrees with the manifests, so a bump meant for a commit
-    // has to bring it along. `--ignore-scripts` because nothing here needs a build, and
-    // `--package-lock-only` because nothing here needs node_modules touched either.
-    console.log('reconciling package-lock.json');
-    execFileSync('npm', ['install', '--package-lock-only', '--ignore-scripts'], {
-      cwd: root,
-      stdio: 'inherit',
-      shell: process.platform === 'win32',
-    });
-  }
-}
-
-await main();

package/scripts/set-version.test.ts

@@ -1,220 +0,0 @@
-import { execFile } from 'node:child_process';
-import { cp, mkdtemp, readFile, readdir, rm, writeFile, mkdir } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { promisify } from 'node:util';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-
-const run = promisify(execFile);
-const repo = join(dirname(fileURLToPath(import.meta.url)), '..');
-
-/**
- * The version bump, which is the one edit a release cannot get wrong.
- *
- * Twelve packages name each other by exact version, so moving a version means moving every pin that
- * names it — thirty-eight fields across thirteen manifests at the time of writing. Every release
- * before this script was a hand-written commit doing that, and `npm version --workspaces` does not
- * help: it moves each package's own `version` and leaves its dependents pointing at the old one.
- *
- * The failure this guards is not a red test later. A pin left behind publishes
- * `agenticreplay@0.2.4` depending on `@agenticreplay/core@0.2.3`, and npm never allows a version to be
- * re-published — so it is wrong on the registry permanently. `publish-order.mjs` is the other half
- * of the guard and every release runs it; this pins the shape it is checking.
- */
-describe('set-version', () => {
-  let work: string;
-
-  /** A copy of the real manifests, so the assertions are about this repository's actual graph. */
-  beforeEach(async () => {
-    work = await mkdtemp(join(tmpdir(), 'agenticreplay-setver-'));
-    await cp(join(repo, 'package.json'), join(work, 'package.json'));
-    await mkdir(join(work, 'scripts'), { recursive: true });
-    await cp(join(repo, 'scripts', 'set-version.mjs'), join(work, 'scripts', 'set-version.mjs'));
-    await cp(
-      join(repo, 'scripts', 'publish-order.mjs'),
-      join(work, 'scripts', 'publish-order.mjs'),
-    );
-    await cp(join(repo, 'packages'), join(work, 'packages'), {
-      recursive: true,
-      filter: (src) => !src.includes('node_modules') && !src.includes(`${'dist'}`),
-    });
-  });
-
-  afterEach(async () => {
-    await rm(work, { recursive: true, force: true });
-  });
-
-  const setVersion = (...args: string[]) =>
-    run(process.execPath, [join(work, 'scripts', 'set-version.mjs'), ...args], { cwd: work });
-
-  const manifest = async (rel: string) =>
-    JSON.parse(await readFile(join(work, rel), 'utf8')) as {
-      version?: string;
-      dependencies?: Record<string, string>;
-    };
-
-  it('moves every version and every internal pin together', async () => {
-    await setVersion('1.2.3');
-
-    const cli = await manifest('packages/cli/package.json');
-    expect(cli.version).toBe('1.2.3');
-    // The pins are the half `npm version` leaves behind.
-    for (const [name, range] of Object.entries(cli.dependencies ?? {})) {
-      if (!name.startsWith('@agenticreplay/')) continue;
-      expect(range, `${name} was left naming the old version`).toBe('1.2.3');
-    }
-    expect((await manifest('packages/core/package.json')).version).toBe('1.2.3');
-    expect((await manifest('package.json')).version).toBe('1.2.3');
-  });
-
-  it('leaves a third-party dependency alone', async () => {
-    // `@agenticreplay/schema` rather than the CLI: the CLI ships with no runtime dependency at all,
-    // so it cannot show that an outside range survives. Both the root's devDependencies and
-    // schema's `ajv` are checked, because the fields are walked separately.
-    const schema = 'packages/schema/package.json';
-    const before = (await manifest(schema)).dependencies ?? {};
-    const outside = Object.entries(before).filter(([n]) => !n.startsWith('@agenticreplay/'));
-    expect(outside.length, 'schema has no external dependency to check').toBeGreaterThan(0);
-    const rootDev = (
-      JSON.parse(await readFile(join(work, 'package.json'), 'utf8')) as {
-        devDependencies?: Record<string, string>;
-      }
-    ).devDependencies;
-
-    await setVersion('1.2.3');
-
-    const after = (await manifest(schema)).dependencies ?? {};
-    for (const [name, range] of outside) expect(after[name], name).toBe(range);
-    const rootAfter = (
-      JSON.parse(await readFile(join(work, 'package.json'), 'utf8')) as {
-        devDependencies?: Record<string, string>;
-      }
-    ).devDependencies;
-    expect(rootAfter, 'a devDependency on prettier is not a version to bump').toEqual(rootDev);
-  });
-
-  it('satisfies publish-order, which is what a release gates on', async () => {
-    for (const version of ['1.2.3', '0.2.4-main.90fc463']) {
-      await setVersion(version);
-      // Exits non-zero and names the offender if any pin disagrees.
-      const { stdout } = await run(process.execPath, [join(work, 'scripts', 'publish-order.mjs')], {
-        cwd: work,
-      });
-      expect(stdout.trim().split(/\r?\n/).length, 'every package should be publishable').toBe(12);
-    }
-  });
-
-  it('accepts a prerelease, because that is what the next channel publishes', async () => {
-    await setVersion('0.2.4-main.90fc463');
-    expect((await manifest('packages/cli/package.json')).version).toBe('0.2.4-main.90fc463');
-    expect(
-      (await manifest('packages/cli/package.json')).dependencies?.['@agenticreplay/core'],
-    ).toBe('0.2.4-main.90fc463');
-  });
-
-  it('refuses a range, and build metadata, rather than publishing something unfixable', async () => {
-    const paths = [
-      'package.json',
-      ...(await readdir(join(work, 'packages'))).map((name) => `packages/${name}/package.json`),
-    ];
-    const before = await Promise.all(paths.map((path) => readFile(join(work, path), 'utf8')));
-    // A range would resolve to whatever is latest; build metadata is ignored when npm compares
-    // versions, so two different trees could claim the same version on the registry.
-    for (const bad of ['^1.2.3', '1.2', 'latest', '1.2.3+build']) {
-      await expect(setVersion(bad), `"${bad}" should be refused`).rejects.toThrow();
-      // Refusal must preserve every manifest, even if the private root has a different version.
-      const after = await Promise.all(paths.map((path) => readFile(join(work, path), 'utf8')));
-      expect(after, `"${bad}" must not change any manifest`).toEqual(before);
-    }
-  });
-
-  /**
-   * A numeric prerelease identifier with a leading zero, which npm rewrites rather than refuses.
-   *
-   * `0.2.4-main.0123456` is invalid semver, and `npm publish` does not say so. It runs the manifest
-   * through `@npmcli/package-json`'s `fix()`, which cleans the *version* to `0.2.4-main.123456`
-   * with a warning and leaves every dependency pin naming `0.2.4-main.0123456`. Measured with
-   * npm's own library:
-   *
-   *     fix() version : 0.2.4-main.123456
-   *     fix() dep pin : 0.2.4-main.0123456
-   *
-   * So twelve packages would go out at one version while declaring dependencies on another that
-   * does not exist, and npm never lets a version be replaced — the channel would be permanently
-   * unresolvable. A short sha does this whenever its first seven characters are all digits and
-   * start with a zero, about one commit in 270, which is why `publish-next.yml` prefixes the sha
-   * with a letter as well.
-   */
-  it('refuses a leading-zero numeric prerelease, which npm would silently rewrite', async () => {
-    for (const bad of ['0.2.4-main.0123456', '0.2.4-01', '1.2.3-0.0123', '01.2.3']) {
-      await expect(setVersion(bad), `"${bad}" should be refused`).rejects.toThrow();
-    }
-    // The shapes that are legal must still pass, or the guard is just refusing prereleases.
-    for (const good of ['0.2.4-main.g0123456', '0.2.4-main.123456', '0.2.4-main.0abc123']) {
-      await expect(setVersion(good), `"${good}" should be accepted`).resolves.toBeTruthy();
-    }
-  });
-
-  /**
-   * The lockfile half, asserted on what is committed rather than on a re-resolve.
-   *
-   * An internal dependency must appear in `package-lock.json` as a link to the workspace, never as
-   * something to fetch. 0.2.1 shipped with two entries resolving `@agenticreplay/*` from the registry,
-   * because `npm version` writes the lockfile at the one moment when the versions have moved and
-   * the pins have not — so npm stopped seeing them as satisfiable workspace links and recorded the
-   * *previous release* instead. Those copies then shadow the source and `tsc` checks the CLI
-   * against last release's `.d.ts`.
-   *
-   * `set-version.mjs --lock` cannot reproduce that, because it fixes the pins before it touches the
-   * lockfile. This guards the outcome anyway: it is cheap, it does not care how the file was
-   * produced, and re-resolving here to prove it would add a minute to the suite.
-   */
-  it('the committed lockfile links internal packages instead of fetching them', async () => {
-    const lock = await readFile(join(repo, 'package-lock.json'), 'utf8');
-    const fetched = [...lock.matchAll(/registry\.npmjs\.org\/(@agenticreplay\/[\w-]+)/g)].map(
-      (m) => m[1],
-    );
-    expect(
-      [...new Set(fetched)],
-      'these are resolved from the registry and must be workspace links',
-    ).toEqual([]);
-  });
-
-  it('is idempotent, and says so', async () => {
-    await setVersion('1.2.3');
-    const first = await readFile(join(work, 'packages/cli/package.json'), 'utf8');
-    const { stdout } = await setVersion('1.2.3');
-    expect(stdout).toContain('nothing to change');
-    expect(await readFile(join(work, 'packages/cli/package.json'), 'utf8')).toBe(first);
-  });
-
-  it('--check writes nothing', async () => {
-    const before = await readFile(join(work, 'packages/cli/package.json'), 'utf8');
-    const { stdout } = await setVersion('9.9.9', '--check');
-    expect(stdout).toContain('would change');
-    expect(await readFile(join(work, 'packages/cli/package.json'), 'utf8')).toBe(before);
-  });
-
-  it('round-trips, so a release that is rolled back leaves no trace', async () => {
-    const before = await readFile(join(work, 'packages/cli/package.json'), 'utf8');
-    const original = (await manifest('packages/cli/package.json')).version!;
-    await setVersion('0.2.4-main.90fc463');
-    await setVersion(original);
-    expect(await readFile(join(work, 'packages/cli/package.json'), 'utf8')).toBe(before);
-  });
-
-  it('rewrites a workspace protocol, which publish-order would reject', async () => {
-    // Not hypothetical: `workspace:*` is what npm/pnpm docs suggest, and it cannot be published.
-    const path = join(work, 'packages/cli/package.json');
-    const pkg = JSON.parse(await readFile(path, 'utf8'));
-    pkg.dependencies['@agenticreplay/core'] = 'workspace:*';
-    await writeFile(path, `${JSON.stringify(pkg, null, 2)}\n`);
-
-    await setVersion('1.2.3');
-
-    expect(
-      (await manifest('packages/cli/package.json')).dependencies?.['@agenticreplay/core'],
-    ).toBe('1.2.3');
-  });
-});

package/scripts/sync-server-json.mjs

@@ -1,13 +0,0 @@
-// `server.json` carries its own version, and the MCP Registry rejects a publish whose version it
-// has already seen. Deriving it from the tag keeps one number in one place: forget to edit this
-// file and the release fails, which is the wrong failure to have at publish time.
-import { readFileSync, writeFileSync } from 'node:fs';
-
-const version = process.argv[2];
-if (!version) throw new Error('usage: sync-server-json.mjs <version>');
-
-const manifest = JSON.parse(readFileSync('server.json', 'utf8'));
-manifest.version = version;
-for (const pkg of manifest.packages ?? []) pkg.version = version;
-writeFileSync('server.json', `${JSON.stringify(manifest, null, 2)}\n`);
-console.log(`server.json -> ${version}`);

package/scripts/update-opencode-api-bases.mjs

@@ -1,29 +0,0 @@
-import { readFile, writeFile } from 'node:fs/promises';
-import { format } from 'prettier';
-
-// Optional local input makes updating from an already downloaded catalog reproducible/offline.
-const source = 'https://models.opencode.ai/api.json';
-const catalog = process.argv[2]
-  ? JSON.parse(await readFile(process.argv[2], 'utf8'))
-  : await fetch(source, { signal: AbortSignal.timeout(30_000) }).then((response) => {
-      if (!response.ok) throw new Error(`Catalog HTTP ${response.status}`);
-      return response.json();
-    });
-const bases = new Set();
-for (const provider of Object.values(catalog)) {
-  if (typeof provider.api === 'string' && provider.api) bases.add(provider.api);
-  for (const model of Object.values(provider.models ?? {})) {
-    if (typeof model.provider?.api === 'string' && model.provider.api)
-      bases.add(model.provider.api);
-  }
-}
-if (!bases.size) throw new Error('Catalog contains no API bases');
-await writeFile(
-  new URL('../packages/adapters/src/opencode-api-bases.ts', import.meta.url),
-  await format(
-    `// Generated by scripts/update-opencode-api-bases.mjs from ${source}\n` +
-      `// API templates only; no model metadata or credentials.\n` +
-      `export const OPENCODE_API_BASES: string[] = ${JSON.stringify([...bases].sort(), null, 2)};\n`,
-    { parser: 'typescript', singleQuote: true, printWidth: 100 },
-  ),
-);