compound-agent 2.0.0 → 2.0.2

package/CHANGELOG.md

@@ -7,6 +7,30 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.0.2] - 2026-03-22
+
+### Fixed
+
+- **Silent empty-result messages**: `search`, `load-session`, and `check-plan` commands showed no output when no results found (missing trailing newline merged text with shell prompt).
+- **Setup command output**: `setup` now shows the same detailed breakdown as `init` (directories created, template counts by type, AGENTS.md/CLAUDE.md status).
+- **Beads status reporting**: `init` and `setup` now report whether beads CLI is installed and whether the repo is initialized. Shows install instructions if missing.
+
+## [2.0.1] - 2026-03-22
+
+### Changed
+
+- **Platform-specific npm distribution**: Switch from postinstall-only binary download to industry-standard optional dependencies pattern (`@syottos/{os}-{arch}`). Works with pnpm out of the box — no `approve-builds` needed.
+- **Lazy download fallback**: If platform packages are missing and postinstall was blocked, the bin wrapper downloads the binary on first use from GitHub Releases.
+- **Non-fatal postinstall**: Postinstall no longer crashes `npm install` on download failure — the lazy fallback handles it.
+- **npm publish provenance**: All packages published with `--provenance` for supply chain transparency.
+- **Checksum verification in CI**: Release workflow verifies SHA256 checksums before publishing to npm.
+- **Version-aware skip logic**: Postinstall checks binary version matches package version, preventing stale binaries after upgrades.
+
+### Added
+
+- **Weekly npm token health check**: Scheduled workflow verifies `NPM_TOKEN` validity every Monday.
+- **Platform publish script**: `scripts/publish-platforms.cjs` handles creating and publishing `@syottos/*` packages during releases. Idempotent — safe to re-run.
+
 ## [Unreleased]
 
 ### Changed

package/bin/ca

@@ -1,32 +1,73 @@
 #!/usr/bin/env node
 
 // Thin wrapper that spawns the Go binary.
-// Uses Node.js only for locating the binary; all work is done by the Go process.
+// Resolution order:
+//   1. CA_BINARY_PATH env override
+//   2. Platform-specific npm package (@syottos/{os}-{arch})
+//   3. Postinstall-downloaded binary (./ca-binary)
+//   4. Local Go dev build (../go/dist/ca)
+//   5. Lazy download from GitHub Releases (fallback when postinstall was blocked)
 
 import { execFileSync } from "node:child_process";
 import { existsSync } from "node:fs";
 import { resolve, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
+import { createRequire } from "node:module";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
+const require = createRequire(import.meta.url);
 
-// Resolution order: env override → postinstall binary → local Go build
-const candidates = [
-  process.env.CA_BINARY_PATH,
-  resolve(__dirname, "ca-binary"),
-  resolve(__dirname, "..", "go", "dist", "ca"),
-].filter(Boolean);
+function resolvePlatformBinary() {
+  const pkg = `@syottos/${process.platform}-${process.arch}`;
+  try {
+    const pkgDir = dirname(require.resolve(`${pkg}/package.json`));
+    const bin = resolve(pkgDir, "bin", "ca");
+    if (existsSync(bin)) return bin;
+  } catch {
+    // Platform package not installed
+  }
+  return null;
+}
+
+function findBinary() {
+  const candidates = [
+    process.env.CA_BINARY_PATH,
+    resolvePlatformBinary(),
+    resolve(__dirname, "ca-binary"),
+    resolve(__dirname, "..", "go", "dist", "ca"),
+  ].filter(Boolean);
+
+  return candidates.find((p) => existsSync(p)) || null;
+}
 
-const binaryPath = candidates.find((p) => existsSync(p));
+let binaryPath = findBinary();
+
+// Lazy download: if no binary found, try running the postinstall script on-the-fly.
+// This handles: pnpm blocking postinstall + platform packages not published (expired token).
+if (!binaryPath) {
+  const postinstall = resolve(__dirname, "..", "scripts", "postinstall.cjs");
+  if (existsSync(postinstall)) {
+    try {
+      console.error("[compound-agent] Binary not found, downloading from GitHub Releases...");
+      execFileSync(process.execPath, [postinstall], {
+        stdio: "inherit",
+        env: { ...process.env, npm_package_name: "" },
+      });
+      binaryPath = findBinary();
+    } catch {
+      // Download failed, fall through to error
+    }
+  }
+}
 
 if (!binaryPath) {
-  console.error("[compound-agent] Binary not found. Try reinstalling compound-agent or run: cd go && make build");
+  console.error("[compound-agent] Binary not found and download failed.");
+  console.error("[compound-agent] Try: pnpm approve-builds && pnpm install compound-agent");
   process.exit(1);
 }
 
 try {
   execFileSync(binaryPath, process.argv.slice(2), { stdio: "inherit" });
 } catch (err) {
-  // execFileSync throws on non-zero exit codes; forward the exit code
   process.exit(err.status || 1);
 }

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "compound-agent",
-  "version": "2.0.0",
+  "version": "2.0.2",
+  "type": "module",
   "description": "Learning system for Claude Code — avoids repeating mistakes across sessions",
   "bin": {
     "ca": "./bin/ca",
@@ -48,6 +49,12 @@
     "tdd",
     "knowledge-management"
   ],
+  "optionalDependencies": {
+    "@syottos/darwin-arm64": "2.0.2",
+    "@syottos/darwin-x64": "2.0.2",
+    "@syottos/linux-arm64": "2.0.2",
+    "@syottos/linux-x64": "2.0.2"
+  },
   "author": "Nathan Delacrétaz",
   "license": "MIT",
   "engines": {

package/scripts/postinstall.cjs

@@ -50,7 +50,7 @@ function verifyChecksum(filePath, artifactName, checksumsPath) {
   return actualHash === expectedHash;
 }
 
-function shouldSkipDownload(binDir) {
+function shouldSkipDownload(binDir, expectedVersion) {
   const caPath = path.join(binDir, "ca-binary");
   const embedPath = path.join(binDir, "ca-embed");
 
@@ -59,8 +59,11 @@ function shouldSkipDownload(binDir) {
   }
 
   try {
-    // P1-2 fix: use execFileSync (no shell) instead of execSync
-    execFileSync(caPath, ["version"], { stdio: "pipe" });
+    const output = execFileSync(caPath, ["version"], { stdio: "pipe", encoding: "utf-8" });
+    // Verify version matches to prevent stale binaries after upgrade
+    if (expectedVersion && !output.includes(expectedVersion)) {
+      return false;
+    }
     return true;
   } catch {
     return false;
@@ -89,13 +92,15 @@ function downloadFile(url, dest) {
           }
 
           if (res.statusCode !== 200) {
+            res.resume(); // Drain response to free the socket
             reject(new Error(`Download failed: HTTP ${res.statusCode} from ${currentUrl}`));
             return;
           }
 
           const file = fs.createWriteStream(dest);
           res.pipe(file);
-          file.on("finish", resolve);
+          file.on("finish", () => file.close());
+          file.on("close", resolve);
           file.on("error", (err) => {
             fs.unlink(dest, () => {});
             reject(err);
@@ -133,10 +138,26 @@ function cleanupBinaries(binDir) {
   }
 }
 
+function platformPackageInstalled() {
+  const pkg = `@syottos/${require("os").platform()}-${require("os").arch()}`;
+  try {
+    const pkgDir = path.dirname(require.resolve(`${pkg}/package.json`));
+    return fs.existsSync(path.join(pkgDir, "bin", "ca"));
+  } catch {
+    return false;
+  }
+}
+
 async function main() {
   // Skip self-install (when running pnpm install inside compound-agent itself)
   if (process.env.npm_package_name === "compound-agent") return;
 
+  // Skip if platform-specific package already provides the binary
+  if (platformPackageInstalled()) {
+    console.log("[compound-agent] Binary provided by platform package, skipping download");
+    return;
+  }
+
   const platformKey = getPlatformKey(
     require("os").platform(),
     require("os").arch()
@@ -147,7 +168,7 @@ async function main() {
 
   const binDir = path.resolve(__dirname, "../bin");
 
-  if (shouldSkipDownload(binDir)) {
+  if (shouldSkipDownload(binDir, version)) {
     console.log("[compound-agent] Binaries already installed, skipping download");
     return;
   }
@@ -168,7 +189,9 @@ async function main() {
 
     // Download both binaries in parallel (to .tmp names)
     const caArtifact = `ca-${platformKey}`;
-    const embedArtifact = `ca-embed-${platformKey}`;
+    // No x86_64 macOS embed build (ort-sys limitation) — use arm64 via Rosetta
+    const embedKey = platformKey === "darwin-amd64" ? "darwin-arm64" : platformKey;
+    const embedArtifact = `ca-embed-${embedKey}`;
 
     await Promise.all([
       downloadBinary(binDir, `${baseUrl}/${caArtifact}`, "ca-binary", "CLI binary"),
@@ -205,10 +228,11 @@ async function main() {
       throw new Error("Binary downloaded but functional check failed (ca version exited non-zero)");
     }
   } catch (err) {
-    console.error(`[compound-agent] Installation failed: ${err.message}`);
-    console.error("[compound-agent] You can manually download binaries from:");
-    console.error(`[compound-agent]   https://github.com/${REPO}/releases/tag/v${version}`);
-    process.exit(1);
+    // Non-fatal: the bin/ca wrapper will retry via lazy download on first run.
+    // Exiting 0 so npm/pnpm install doesn't fail.
+    console.warn(`[compound-agent] Postinstall download failed: ${err.message}`);
+    console.warn("[compound-agent] The binary will be downloaded on first use.");
+    console.warn(`[compound-agent] Or manually download from: https://github.com/${REPO}/releases/tag/v${version}`);
   }
 }