dsh-supermemory 0.1.0 → 0.1.1

package/README.md

@@ -199,28 +199,55 @@ Requires Node `^22.19.0 || >=24.0.0`.
 
 ## Releasing
 
-Publishing runs from GitHub Actions through npm **trusted publishing (OIDC)** — no `NPM_TOKEN` secret exists, and every release carries provenance.
+Publishing runs from GitHub Actions through npm **trusted publishing (OIDC)** — no `NPM_TOKEN` secret exists, and every release carries provenance. CI does not publish on its own: it *stages* the release, and a human approves it with a 2FA code.
 
-One-time setup on npm: open <https://www.npmjs.com/package/dsh-supermemory/access>, add a trusted publisher, choose GitHub Actions, and enter organization `nmindz`, repository `dsh-supermemory`, workflow `.github/workflows/release.yml`, environment `npm`.
+One-time setup on npm: open <https://www.npmjs.com/package/dsh-supermemory/access>, add a trusted publisher, choose GitHub Actions, and enter organization `nmindz`, repository `dsh-supermemory`, workflow `.github/workflows/release.yml`, environment `production`. Under **Allowed actions**, leave *publish directly* unchecked — staged publishing is all this workflow needs, and it keeps CI from holding a credential that can ship a version by itself.
 
-Then each release is a version bump and a tag:
+### Conventional Commits drive the version
+
+There is no manual version bump and no hand-written tag. [semantic-release](https://semantic-release.gitbook.io) reads the [Conventional Commits](https://www.conventionalcommits.org) since the last release and decides everything else — the version, `CHANGELOG.md`, the git tag, and the GitHub Release.
+
+| Commit | Result |
+|---|---|
+| `fix: …` | patch — `0.1.0` → `0.1.1` |
+| `feat: …` | minor — `0.1.0` → `0.2.0` |
+| `feat!: …` or a `BREAKING CHANGE:` footer | major |
+| `perf: …`, `refactor: …` | patch |
+| `docs: …`, `test: …`, `chore: …`, `ci: …`, `build: …`, `style: …` | no release |
+
+So a release is just a merge to `master`:
+
+```sh
+git commit -m 'fix: render the status line from a symlinked install path'
+git push origin master
+```
+
+CI validates the commit, the release workflow runs once CI is green, and if the commits warrant a version it bumps `package.json`, writes `CHANGELOG.md`, tags `vX.Y.Z`, opens the GitHub Release, and stages the npm publish. Pull requests get their commit messages linted so a malformed one cannot silently cost a release.
+
+The version then waits for you:
 
 ```sh
-npm version 0.1.1 --no-git-tag-version   # edits package.json only
-git commit -am 'Release v0.1.1'
-git tag v0.1.1
-git push origin master --tags
+npm stage list dsh-supermemory   # find the stage id
+npm stage view <stage-id>        # inspect the tarball and provenance
+npm stage approve <stage-id>     # publishes it; asks for your 2FA code
+npm stage reject <stage-id>      # discards it instead
 ```
 
-The workflow refuses to publish when the tag and `package.json` version disagree, and runs `pnpm run check` before it publishes.
+Requires npm ≥ 11.19 locally (`npm install -g npm@latest`).
 
-To publish by hand instead (requires `npm login` or a configured token):
+To publish by hand instead, skipping staging entirely:
 
 ```sh
 pnpm run check
 npm publish --access public
 ```
 
+Run semantic-release in CI only. It moves git refs as part of its work, and in a jj-colocated checkout jj re-imports those refs and rolls the working copy back onto them — locally it looks like it ate your unpushed commits. They are recoverable with `jj op log` and `jj op restore <op-id>`, but the tool has no business running there.
+
+### What a release costs
+
+The package is built exactly once per commit. CI's `build` job produces `lib/`, verifies the tarball still carries the skill body and both auth templates, and uploads it; the release workflow downloads that artifact rather than rebuilding, and stages with `--ignore-scripts` so `prepublishOnly` does not rebuild either. Installs in CI use `--ignore-scripts` too, since the package's `prepare` hook exists only to make a git install usable. Runs on a superseded commit cancel themselves.
+
 ## License
 
 MIT. Derived from the MIT-licensed Claude Code `supermemory` plugin — see [NOTICE](NOTICE) for the file-by-file attribution. Supermemory, the `◪` mark, and the Supermemory brand belong to Supermemory; this is an independent port, not an official release.

package/lib/index.mjs

@@ -1002,7 +1002,7 @@ function statuslineTip() {
 		if (fs.existsSync(STATUSLINE_TIP_FILE)) return null;
 		fs.mkdirSync(path.dirname(STATUSLINE_TIP_FILE), { recursive: true });
 		fs.writeFileSync(STATUSLINE_TIP_FILE, (/* @__PURE__ */ new Date()).toISOString());
-		return `${MARK} supermemory status is live — render it anywhere with \`node -e "require('dsh-supermemory/statusline')" <<< '{"session_id":"…"}'\`, or read ~/.supermemory-claude/statusline.`;
+		return `${MARK} supermemory status is live — render it anywhere with \`echo '{"session_id":"…"}' | node -e "import('dsh-supermemory/statusline')"\`, or read ~/.supermemory-claude/statusline.`;
 	} catch {
 		return null;
 	}

package/lib/statusline.mjs

@@ -1,3 +1,4 @@
+import { fileURLToPath } from "node:url";
 import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
@@ -198,6 +199,24 @@ async function main() {
 		if (output) process.stdout.write(output);
 	} catch {}
 }
-if (process.argv[1] && import.meta.url === `file://${process.argv[1]}`) main();
+/**
+* Whether this module was run as the entry point.
+*
+* Comparing `import.meta.url` to `file://${process.argv[1]}` is wrong twice
+* over: the template leaves spaces and other reserved characters unescaped,
+* and `import.meta.url` is already resolved through symlinks while `argv[1]`
+* is not — so on macOS a script under `/tmp` (a symlink to `/private/tmp`)
+* never matched and the renderer silently printed nothing. Compare real paths.
+*/
+function invokedDirectly() {
+	const entry = process.argv[1];
+	if (!entry) return false;
+	try {
+		return fs.realpathSync(fileURLToPath(import.meta.url)) === fs.realpathSync(entry);
+	} catch {
+		return false;
+	}
+}
+if (invokedDirectly()) main();
 //#endregion
 export { CONTEXT_TTL_MS, ERROR_TTL_MS, SAVING_TTL_MS, STATUSLINE_INPUT_TIMEOUT_MS, TICK_MS, getStatusLabel, readState, readStatuslineInput, renderStatusline };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-supermemory",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Persistent memory across DeepSeek Harness (DSH) sessions using Supermemory. A native port of the Claude Code supermemory plugin.",
   "keywords": [
     "dsh",
@@ -85,6 +85,8 @@
     }
   },
   "devDependencies": {
+    "@commitlint/cli": "^21.2.2",
+    "@commitlint/config-conventional": "^21.2.2",
     "@deepseek-ai/cordis": "^4.0.2",
     "@deepseek-ai/dsh-agent": "0.1.2-rc.1",
     "@deepseek-ai/dsh-commands": "0.1.2-rc.1",
@@ -93,7 +95,16 @@
     "@deepseek-ai/dsh-session": "0.1.2-rc.1",
     "@deepseek-ai/dsh-skill": "0.1.2-rc.1",
     "@deepseek-ai/dsh-tools": "0.1.2-rc.1",
+    "@semantic-release/changelog": "^7.0.0",
+    "@semantic-release/commit-analyzer": "^13.0.1",
+    "@semantic-release/exec": "^7.1.0",
+    "@semantic-release/git": "^11.0.1",
+    "@semantic-release/github": "^12.0.9",
+    "@semantic-release/npm": "^13.1.5",
+    "@semantic-release/release-notes-generator": "^14.1.1",
     "@types/node": "^24.10.0",
+    "conventional-changelog-conventionalcommits": "^9.3.1",
+    "semantic-release": "^25.0.9",
     "tsdown": "^0.22.2",
     "typescript": "^6.0.0"
   },
@@ -109,6 +120,14 @@
       ]
     }
   },
+  "scripts": {
+    "build": "tsdown",
+    "prepare": "tsdown",
+    "typecheck": "tsc --noEmit",
+    "test": "node --test --experimental-strip-types test/*.test.ts",
+    "check": "npm run typecheck && npm test && npm run build",
+    "prepublishOnly": "npm run check"
+  },
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -117,11 +136,5 @@
   "bugs": {
     "url": "https://github.com/nmindz/dsh-supermemory/issues"
   },
-  "homepage": "https://github.com/nmindz/dsh-supermemory#readme",
-  "scripts": {
-    "build": "tsdown",
-    "typecheck": "tsc --noEmit",
-    "test": "node --test --experimental-strip-types test/*.test.ts",
-    "check": "npm run typecheck && npm test && npm run build"
-  }
-}
+  "homepage": "https://github.com/nmindz/dsh-supermemory#readme"
+}