bod-cli 0.10.4 → 0.10.6

package/.github/workflows/publish.yml

@@ -39,10 +39,23 @@ jobs:
           git add package.json
           git commit -m "chore: release v${VERSION} [skip ci]"
 
+      - name: Pull NPM_TOKEN from bodify secrets store
+        # The npm token is NOT a per-repo secret — a repo-scoped NPM_TOKEN goes stale silently and every
+        # publish then dies on a 404. Pull the canonical token from bodify at publish time, so rotating it
+        # in ONE place fixes every repo. Only GitHub secret needed: BODIFY_API_KEY.
+        env:
+          BODIFY_API_KEY: ${{ secrets.BODIFY_API_KEY }}
+        run: |
+          TOKEN=$(curl -fsS -H "Authorization: Bearer $BODIFY_API_KEY" \
+            "https://bodify.bod.ee/api/apps/9ddba0fb-03bc-4490-8577-5e094b5b6792/env/NPM_TOKEN?environment=prod" \
+            | jq -r '.value')
+          [ -n "$TOKEN" ] && [ "$TOKEN" != "null" ] || { echo "::error::could not fetch NPM_TOKEN from bodify"; exit 1; }
+          echo "::add-mask::$TOKEN"
+          echo "NODE_AUTH_TOKEN=$TOKEN" >> "$GITHUB_ENV"
       - name: Publish to npm
         run: npm publish --access public
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ env.NODE_AUTH_TOKEN }}
 
       - name: Push tag
         run: |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bod-cli",
-  "version": "0.10.4",
+  "version": "0.10.6",
   "type": "module",
   "bin": {
     "bod": "./src/cli.ts"

package/src/utils/excludes.ts

@@ -47,8 +47,12 @@ export const DEFAULT_EXCLUDES: { pattern: string; why: string }[] = [
   { pattern: '.tmp', why: 'repo-wide scratch convention — never runtime input' },
   { pattern: 'scratchpad', why: 'agent scratch dir, same class as .tmp' },
   { pattern: '.bodify', why: 'local `bod serve` state / dev database' },
-  { pattern: '.mcp-android', why: 'local device-automation MCP state' },
-  { pattern: '.mcp-ios', why: 'local device-automation MCP state' },
+  // Enumerating these by hand is what failed: `.mcp-android`/`.mcp-ios` were listed
+  // while `.mcp-playwright/profile` (41.8MB) and `.mcp-cursor/cache` (7.3MB) sailed
+  // through on para-li. The family is the unit, not each member. Still a BARE
+  // pattern (no leading `*/`), so it matches at top level too — pinned by test.
+  { pattern: '.mcp-*', why: 'local MCP tool state (android/ios/playwright/cursor/…)' },
+  { pattern: '.bodify-bak*', why: 'local `bod serve` db backups — same class as .bodify' },
   { pattern: '.frame-dev', why: 'frame dev-server cache' },
   { pattern: '.DS_Store', why: 'macOS Finder metadata' },
 ]

package/test/excludes.test.ts

@@ -28,6 +28,9 @@ beforeAll(() => {
   f('packages/x/.agent/state.json')
   f('.claude/settings.json'); f('.cursor/rules'); f('.tmp/junk'); f('scratchpad/note')
   f('.bodify/dev.db'); f('.mcp-ios/x'); f('.mcp-android/x'); f('.vscode/settings.json')
+  // the family members hand-enumeration missed on para-li (41.8MB + 7.3MB)
+  f('.mcp-playwright/profile/p.bin'); f('.mcp-cursor/cache/c.bin')
+  f('packages/x/.mcp-ios/s.json'); f('.bodify-bak-1/data.db')
   f('.frame-dev/cache'); f('.DS_Store'); f('.env.local', 'SECRET=1')
   // per-app exclusion target
   f('native/App.js')
@@ -37,6 +40,7 @@ beforeAll(() => {
   f('dist/bundle.js', 'built')                     // re-included via the `!dist` escape hatch
   f('src/store/index.ts')                          // a real source dir named like a hand-rolled exclude
   f('src/test/unit.ts')
+  f('src/mcp-client/keep.ts')                      // a real source dir the `.mcp-*` family must NOT eat
 })
 afterAll(() => {
   rmSync(FIX, { recursive: true, force: true })
@@ -97,6 +101,8 @@ describe('the real upload tarball', () => {
       '.claude/settings.json', '.cursor/rules', '.tmp/junk', 'scratchpad/note',
       '.bodify/dev.db', '.mcp-ios/x', '.mcp-android/x', '.vscode/settings.json',
       '.frame-dev/cache', '.DS_Store', '.env.local',
+      '.mcp-playwright/profile/p.bin', '.mcp-cursor/cache/c.bin',
+      'packages/x/.mcp-ios/s.json', '.bodify-bak-1/data.db',
     ]) expect(members).not.toContain(gone)
   })
 
@@ -115,6 +121,7 @@ describe('the real upload tarball', () => {
     expect(members).toContain('config.generated.json') // untracked-but-needed
     expect(members).toContain('src/store/index.ts')
     expect(members).toContain('src/test/unit.ts')
+    expect(members).toContain('src/mcp-client/keep.ts') // `.mcp-*` is dot-anchored, not a substring
   })
 })