claude-use 0.2.10 → 0.3.3

package/README.md

@@ -519,6 +519,18 @@ The resolver closes this by treating every materialised directory as a two-way s
 
 The reverse direction matters just as much: a directory materialised because of a split whose cause later disappears (a profile edit removes the entry override that split it, say) collapses back into a single plain symlink on the next resync, rather than being left behind as permanent local scaffolding. This is the same "compare against prior farm state, update only what changed" logic that makes every resync fast in the common case, applied to the one case where a subtree's resolved shape needs to get simpler, not just different.
 
+### Automated releases (semantic-release)
+
+Every push to `main` (never a tag push — the `semantic-release` job's own `if:` checks `github.ref == 'refs/heads/main'` specifically) runs [semantic-release](https://github.com/semantic-release/semantic-release) after `check` passes. It analyses every commit since the last `vX.Y.Z` tag using the `conventionalcommits` preset — the same convention this project's own commitlint config already enforces — and decides whether a release is warranted at all: a `feat:` commit bumps minor, `fix:`/`perf:` bump patch, a `BREAKING CHANGE:` footer bumps major, and anything else (`chore:`, `docs:`, `ci:`, `test:`) triggers no release on its own. If a release is warranted, it creates and pushes the next tag itself — exactly the step that used to be a manual `git tag`/`git push` earlier in this project's life.
+
+`.releaserc.json` configures five plugins, in this order: `@semantic-release/commit-analyzer` and `@semantic-release/release-notes-generator` (both `conventionalcommits`-preset, deciding the version and generating notes text), `@semantic-release/changelog` (writes `CHANGELOG.md`), `@semantic-release/npm` with **`npmPublish: false`** (bumps `package.json`'s version field and stages it, but never touches the npm registry), `@semantic-release/git` (commits `CHANGELOG.md` + `package.json` with a `chore(release): X.Y.Z [skip ci]` message and pushes it to `main`), and `@semantic-release/exec` (see below). `@semantic-release/github` is not loaded at all. This split is deliberate: semantic-release owns only the version *decision*, the tag, and the changelog — actual npm publishing (this project's own OIDC trusted-publishing job, below), GitHub Release creation (with this project's own multi-platform asset list and release-notes body, not semantic-release's generic one), and the Homebrew/Scoop tap updates all remain this project's existing tag-triggered jobs, completely unchanged. The `[skip ci]` marker on the changelog commit stops it from re-triggering `check`/`semantic-release` on `main`.
+
+One accepted quirk worth knowing rather than being surprised by: semantic-release creates the release tag pointing at the commit that already existed (the actual code change being released) *before* running `@semantic-release/git`'s commit step — so the changelog/version-bump commit lands on `main` **after** the tag, not folded into it. This means checking out a given `vX.Y.Z` tag shows the *previous* version in `package.json` until the next release's tag moves past this commit. This is standard, widely-accepted semantic-release behaviour, not a bug — and harmless here specifically because every job downstream (`publish-npm`'s `npm pkg set version="${GITHUB_REF_NAME#v}"`, every build/verify job's own version assertions) already derives the version from the **tag name** (`GITHUB_REF_NAME`) directly, never from `package.json`'s committed value at that commit.
+
+**Branch/tag protection had to be disabled for this to work.** `main`'s branch-protection ruleset previously required every push go through a reviewed PR, and a separate ruleset blocked tag creation/deletion outright — both only bypassable by the Admin repository role. semantic-release's own git operations run as the workflow's default `GITHUB_TOKEN`, which doesn't hold that role, so both rulesets were disabled (not deleted — the rule definitions are preserved and can be re-enabled with a single API call or via the repo's Rules settings page) rather than routing around them with a separate bypass credential.
+
+**The tag push itself does not trigger the build/publish/verify pipeline below — GitHub Actions never lets a `GITHUB_TOKEN`-authenticated push start a new workflow run, to prevent recursive loops.** This turned out to hold for an SSH deploy key registered on the repository too, not just the default token — confirmed empirically rather than assumed, since most write-ups of this restriction only discuss `GITHUB_TOKEN` and imply any other credential is exempt. `workflow_dispatch` (and `repository_dispatch`) are explicitly exempt, though, so `@semantic-release/exec`'s `successCmd` re-dispatches this same workflow directly against the new tag: `gh workflow run ci.yml --ref ${nextRelease.gitTag}`. The `success` step only fires once semantic-release has actually created a release, so a push with nothing to release skips it entirely rather than dispatching a pointless run. The `semantic-release` job's `permissions: actions: write` is what lets its own `GITHUB_TOKEN` call the dispatch API — `contents: write` covers the tag/commit push, same as before.
+
 ### Build (Node SEA)
 
 `scripts/build.mts` bundles `src/cli.ts` to a single CJS file with esbuild, writes a `sea-config.json` next to it, then invokes the now-stable single command `node --build-sea=sea-config.json` — this one step handles the bundle copy, signature removal, blob injection, and re-signing that used to require chaining `--experimental-sea-config` with a separate `postject` invocation, and `postject` is not a dependency of this project. On macOS the resulting binary is re-signed with an ad-hoc signature (`codesign --sign -`) afterwards, since blob injection invalidates the original one. `--build-sea` requires Node ≥ v25.5.0, the version it stabilised in; the build script checks the running Node version up front and refuses with a clear error rather than failing deep inside the SEA step if it's older.

package/dist/cli.cjs

@@ -221857,7 +221857,7 @@ var categories_default_default = {
 // package.json
 var package_default = {
   name: "claude-use",
-  version: "0.2.10",
+  version: "0.3.3",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "Apache-2.0",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -221904,14 +221904,20 @@ var package_default = {
     "@commitlint/cli": "^21.2.1",
     "@commitlint/config-conventional": "^21.2.0",
     "@eslint/js": "^10.0.1",
+    "@semantic-release/changelog": "^7.0.0",
+    "@semantic-release/exec": "^7.1.0",
+    "@semantic-release/git": "^11.0.1",
+    "@semantic-release/npm": "^13.1.5",
     "@types/node": "^26.1.2",
     "@types/picomatch": "^4.0.3",
+    "conventional-changelog-conventionalcommits": "^10.2.1",
     esbuild: "^0.28.1",
     eslint: "^10.8.0",
     globals: "^17.8.0",
     husky: "^9.1.7",
     jiti: "^2.7.0",
     "lint-staged": "^17.3.0",
+    "semantic-release": "^25.0.8",
     typescript: "^6.0.3",
     "typescript-eslint": "^8.65.0",
     vitest: "^4.1.10"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-use",
-  "version": "0.2.10",
+  "version": "0.3.3",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "Apache-2.0",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",
@@ -47,14 +47,20 @@
     "@commitlint/cli": "^21.2.1",
     "@commitlint/config-conventional": "^21.2.0",
     "@eslint/js": "^10.0.1",
+    "@semantic-release/changelog": "^7.0.0",
+    "@semantic-release/exec": "^7.1.0",
+    "@semantic-release/git": "^11.0.1",
+    "@semantic-release/npm": "^13.1.5",
     "@types/node": "^26.1.2",
     "@types/picomatch": "^4.0.3",
+    "conventional-changelog-conventionalcommits": "^10.2.1",
     "esbuild": "^0.28.1",
     "eslint": "^10.8.0",
     "globals": "^17.8.0",
     "husky": "^9.1.7",
     "jiti": "^2.7.0",
     "lint-staged": "^17.3.0",
+    "semantic-release": "^25.0.8",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.65.0",
     "vitest": "^4.1.10"