demobite 1.3.0 → 1.3.1

package/README.md

@@ -150,9 +150,8 @@ The default installer also attempts to register that MCP with Claude Code when t
 | `skill/` | Studio-connected recorder instructions, login, upload, and Retake. |
 | `scripts/` | Shared browser recording, trimming, and timing calibration. |
 | `recorder/` | Standalone skill and local video finishing tools. |
-| `aliases/` | `agentic-recorder` and `demobites` aliases for the same launcher. |
 
-Run `npx demobite@latest` again to update the installed skill. For publishing instructions, see [RELEASING.md](RELEASING.md).
+The same package is published under three names, `demobite`, `agentic-recorder` and `demobites`, always at the same version; `npx agentic-recorder@latest` and `npx demobites@latest` do exactly what `npx demobite@latest` does. Run it again to update the installed skill. For publishing instructions, see [RELEASING.md](RELEASING.md).
 
 Found something confusing or have an example to share? [Open an issue](https://github.com/demobites/agentic-recorder/issues). Include your operating system, agent, and recorder version. Remove keys, cookies, and private app data from logs or recordings before attaching them.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "demobite",
-  "version": "1.3.0",
-  "description": "The DemoBites agentic recorder \u2014 you prompt, it films a real browser, and DemoBites turns the take into an editable demo bite.",
+  "version": "1.3.1",
+  "description": "The DemoBites agentic recorder — you prompt, it films a real browser, and DemoBites turns the take into an editable demo bite.",
   "bin": {
     "demobite": "launcher/index.mjs"
   },
@@ -36,7 +36,7 @@
   "license": "MIT",
   "type": "module",
   "scripts": {
-    "check-aliases": "node scripts/check-aliases.mjs",
-    "prepublishOnly": "node scripts/check-aliases.mjs"
+    "release": "node scripts/release.mjs",
+    "prepublishOnly": "node scripts/check-release.mjs"
   }
 }

package/scripts/check-release.mjs

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+// prepublishOnly guard: a bare `npm publish` ships ONE of the three names and
+// leaves the other two behind, which is exactly what the founder refused on
+// 2026-09-15. Publish through `npm run release`.
+if (process.env.DEMOBITE_RELEASE !== "1") {
+  console.error("Refusing a bare npm publish: demobite, agentic-recorder and demobites ship together. Run: npm run release");
+  process.exit(1);
+}

package/scripts/release.mjs

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+// RELEASE (founder law, 2026-09-15): one package, three names, one version.
+// `demobite`, `agentic-recorder` and `demobites` on npm are the SAME full
+// package (launcher, skill, recorder, scripts), published together at the
+// same version. No aliases, no caret ranges, nothing to strand.
+//
+//   npm run release            publish package.json's version under all three names
+//   npm run release -- --dry-run
+//
+// For each name the script writes package.json with that name and a bin of
+// the same name, runs `npm publish`, and restores the original package.json
+// (also on failure). A bare `npm publish` is refused by prepublishOnly unless
+// this script set DEMOBITE_RELEASE, so nobody ships one name alone.
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+export const NAMES = ["demobite", "agentic-recorder", "demobites"];
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const pkgPath = path.join(root, "package.json");
+const original = fs.readFileSync(pkgPath, "utf8");
+const base = JSON.parse(original);
+const dryRun = process.argv.includes("--dry-run");
+if (base.name !== "demobite") { console.error(`package.json name is ${base.name}; expected demobite (a previous release did not restore it?)`); process.exit(1); }
+
+const published = [];
+try {
+  for (const name of NAMES) {
+    const pkg = { ...base, name, bin: { [name]: "launcher/index.mjs" } };
+    fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
+    console.log(`\n── ${name}@${base.version}${dryRun ? " (dry run)" : ""}`);
+    const r = spawnSync("npm", ["publish", "--access", "public", ...(dryRun ? ["--dry-run"] : [])], { cwd: root, stdio: "inherit", env: { ...process.env, DEMOBITE_RELEASE: "1" } });
+    if (r.status !== 0) { console.error(`\n${name}@${base.version} did not publish (exit ${r.status}). Published so far: ${published.join(", ") || "none"}. Fix and rerun; npm refuses to republish a version that already landed, so bump the patch if some names went out.`); process.exit(r.status ?? 1); }
+    published.push(name);
+  }
+} finally {
+  fs.writeFileSync(pkgPath, original);
+}
+if (dryRun) { console.log(`\nDry run ok for ${NAMES.join(", ")} at ${base.version}.`); process.exit(0); }
+console.log(`\nPublished ${NAMES.join(", ")} at ${base.version}. Verifying the registry…`);
+let bad = false;
+for (const name of NAMES) {
+  const v = spawnSync("npm", ["view", `${name}@${base.version}`, "version"], { encoding: "utf8" }).stdout.trim();
+  console.log(`  ${v.endsWith(base.version) ? "✓" : "✗"} ${name} → ${v || "(not visible yet)"}`);
+  if (!v.endsWith(base.version)) bad = true;
+}
+if (bad) console.error("Some names are not visible yet; npm can take a minute. Check again with: npm view <name> version");

package/scripts/check-aliases.mjs

@@ -1,42 +0,0 @@
-#!/usr/bin/env node
-// ALIAS GUARD (founder law, 2026-09-09): `agentic-recorder` and `demobites` on
-// npm are aliases of this package. They depend on `demobite` with a caret
-// range, so minor and patch releases flow through automatically, but a MAJOR
-// bump silently strands them on the old major. This guard runs before every
-// publish of demobite (prepublishOnly) and in CI, and refuses to continue if
-// any alias's dependency range no longer covers the version about to ship.
-//
-// When it fails: bump the range in aliases/<name>/package.json (and the alias
-// version), publish each alias from the founder's own terminal, then publish
-// demobite. See RELEASING.md.
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const main = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
-const aliasesDir = path.join(root, "aliases");
-const [major] = main.version.split(".").map(Number);
-
-let failed = false;
-for (const name of fs.readdirSync(aliasesDir)) {
-  const pkgPath = path.join(aliasesDir, name, "package.json");
-  if (!fs.existsSync(pkgPath)) continue;
-  const alias = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
-  const range = alias.dependencies?.demobite ?? "";
-  const m = /^\^(\d+)\./.exec(range);
-  const covered = m && Number(m[1]) === major;
-  const line = `${alias.name.padEnd(18)} depends on demobite ${range.padEnd(8)} → ${covered ? "covers" : "DOES NOT COVER"} ${main.version}`;
-  console.log((covered ? "  ✓ " : "  ✗ ") + line);
-  if (!covered) failed = true;
-  const bin = fs.readFileSync(path.join(aliasesDir, name, "index.mjs"), "utf8");
-  if (!bin.includes('import "demobite/launcher/index.mjs"')) {
-    console.log(`  ✗ ${alias.name} does not import the demobite launcher`);
-    failed = true;
-  }
-}
-if (failed) {
-  console.error("\nAlias guard failed: an npm alias would strand on the old major. Update aliases/*/package.json (range + version), publish the aliases, then publish demobite. See RELEASING.md.");
-  process.exit(1);
-}
-console.log("alias guard: ok");