cannwork-rehearsal 0.3.1 → 0.3.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +25 -9
  2. package/package.json +6 -6
package/README.md CHANGED
@@ -65,6 +65,14 @@ Start the app in watch mode:
65
65
  bun dev
66
66
  ```
67
67
 
68
+ ## Credentials and login
69
+
70
+ - The access token stays in process memory only and is never written to `~/.cannwork-tui/cannwork.json`.
71
+ - The refresh token is encrypted with AES-256-GCM using a key derived from a stable machine fingerprint, then stored as `refreshTokenEnc`; `refreshTokenSavedAt` records when it was written and is metadata only.
72
+ - **Breaking upgrade:** on first launch after upgrading from a version that stored plaintext tokens, the legacy `accessToken`, `refreshToken` and `accessTokenExpiresAt` fields are deleted and you must log in again with `/login` or `/gitcode-token`.
73
+ - If the machine fingerprint changes (host identity or OS user), the stored refresh token can no longer be decrypted and you need to log in again.
74
+ - Multi-instance refreshes are serialized through a SQLite lease lock (`token_refresh_lock`). If the local database is unavailable, the launcher falls back to best-effort refreshes.
75
+
68
76
  ## Scripts
69
77
 
70
78
  | Script | Description |
@@ -83,25 +91,33 @@ Build artifacts are written to `dist/`.
83
91
 
84
92
  ## Maintainer release runbook
85
93
 
86
- Releases are published manually to <https://registry.npmjs.org/> in two phases: an unscoped **trial release** that is kept live for real users, then (later) the official scoped release, after which the trial name is retired.
94
+ Releases are published **manually by the maintainer** to <https://registry.npmjs.org/> in two phases: an unscoped **trial release** that is kept live for real users, then (later) the official scoped release, after which the trial name is retired. AI assistants and other automation must not run a real release — they may only read release files, run checks/tests/builds, and use `--dry-run`.
87
95
 
88
96
  ### Phase 1 — unscoped trial release (kept live)
89
97
 
90
- 1. Set `name` to `cannwork-rehearsal` and `version` to `0.3.0` in the root `package.json` (single source of truth).
98
+ 1. Set `name` to `cannwork-rehearsal` and `version` to the intended version in the root `package.json` (single source of truth). The script never bumps the version or creates git tags for you.
91
99
  2. `npm login` (any account with publish rights).
92
- 3. `bun run release` — runs typecheck + tests, cross-compiles, then publishes the 5 platform packages followed by the main package. Add `--dry-run` to pack and verify without uploading.
93
- 4. Check each package on the registry (`npm view <pkg> version`). A `0.0.0-stage` value means npm staged the version for review; wait for it to go live (or approve it on npmjs.com) before smoke-testing.
94
- 5. Smoke-test in a clean directory: `npx cannwork-rehearsal`. On success the script writes `dist/.rehearsal-ok`, which unlocks phase 2.
95
- 6. **Keep it live**: do not unpublish. During the trial, ship updates by repeating steps 3–5 with a bumped version.
100
+ 3. Optional preview: `bun run release --dry-run`. It prints the release plan (package names, version, package count, sub-packages-before-main order), runs typecheck + tests, cross-compiles, and verifies the packed artifacts **without uploading or asking for confirmation**.
101
+ 4. Real release: run `bun run release` in an **interactive terminal**. After checks, build, and artifact verification it prints the same plan and asks `确认发布 <name>@<version>…`; only `y` / `yes` continues. Any other input (including an empty line) cancels with exit code 0 and uploads nothing.
102
+ 5. The script publishes the 5 platform packages first, then the main package, and finally queries the registry for every package. It succeeds only when all 6 target versions are `live`. If any package is still staged (`0.0.0-stage`) or the query fails, the command exits non-zero, names the package, and tells you to wait for npm to promote it (or approve it on npmjs.com) before smoke-testing.
103
+ 6. Smoke-test in a clean directory: `npx cannwork-rehearsal`. On success the script writes `dist/.rehearsal-ok`, which unlocks phase 2.
104
+ 7. **Keep it live**: do not unpublish. During the trial, ship updates by repeating steps 3–6 with a bumped version.
96
105
 
97
106
  ### Phase 2 — official scoped release (deferred), then retire the trial name
98
107
 
99
- 7. Set `name` to `@zhoufangchaojs/cannwork`, then `bun run release`. The script refuses to publish a scoped name until the trial-release marker exists.
100
- 8. Verify: `npm view @zhoufangchaojs/cannwork version`, smoke-test `npx @zhoufangchaojs/cannwork`, then tag the release:
108
+ 8. Set `name` to `@zhoufangchaojs/cannwork`, then run `bun run release` in an interactive terminal and confirm. The script refuses to publish a scoped name until the trial-release marker exists, and it performs the same registry check afterwards.
109
+ 9. Verify: `npm view @zhoufangchaojs/cannwork version`, smoke-test `npx @zhoufangchaojs/cannwork`, then tag the release yourself (tagging is intentionally outside the script):
101
110
  ```bash
102
111
  git tag <version>
103
112
  ```
104
- 9. Retire the trial packages: `npm unpublish` all 6 (`cannwork-rehearsal` and `cannwork-rehearsal-*`) within the 72-hour window, otherwise `npm deprecate` them as trial packages. If the active credential is a `Granular access token` that bypasses 2FA, unpublish is rejected with 403 — delete the packages on npmjs.com instead, or run `npm login --auth-type=web` first.
113
+ 10. Retire the trial packages: `npm unpublish` all 6 (`cannwork-rehearsal` and `cannwork-rehearsal-*`) within the 72-hour window, otherwise `npm deprecate` them as trial packages. If the active credential is a `Granular access token` that bypasses 2FA, unpublish is rejected with 403 — delete the packages on npmjs.com instead, or run `npm login --auth-type=web` first.
114
+
115
+ ### Release script options
116
+
117
+ - `--dry-run` — plan, check, build, and pack without uploading or confirming.
118
+ - `--yes` — skip the interactive confirmation. Only for rehearsals or explicitly authorized automation; a real release without a TTY is rejected unless this flag is present.
119
+ - `--no-build` / `--skip-checks` — reuse existing artifacts / skip typecheck and tests (use with care).
120
+ - `--root <dir>` — run against another checkout.
105
121
 
106
122
  Rollback: `npm unpublish` the affected version within the allowed window; afterwards `npm deprecate` and publish a fixed version.
107
123
 
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "cannwork-rehearsal",
3
- "version": "0.3.1",
3
+ "version": "0.3.3",
4
4
  "type": "module",
5
5
  "bin": {
6
6
  "cannwork": "bin/cannwork.js"
@@ -10,11 +10,11 @@
10
10
  "README.md"
11
11
  ],
12
12
  "optionalDependencies": {
13
- "cannwork-rehearsal-win32-x64": "0.3.1",
14
- "cannwork-rehearsal-linux-x64": "0.3.1",
15
- "cannwork-rehearsal-linux-arm64": "0.3.1",
16
- "cannwork-rehearsal-darwin-x64": "0.3.1",
17
- "cannwork-rehearsal-darwin-arm64": "0.3.1"
13
+ "cannwork-rehearsal-win32-x64": "0.3.3",
14
+ "cannwork-rehearsal-linux-x64": "0.3.3",
15
+ "cannwork-rehearsal-linux-arm64": "0.3.3",
16
+ "cannwork-rehearsal-darwin-x64": "0.3.3",
17
+ "cannwork-rehearsal-darwin-arm64": "0.3.3"
18
18
  },
19
19
  "publishConfig": {
20
20
  "registry": "https://registry.npmjs.org/",