failproofai 1.0.0-beta.0 → 1.0.0-beta.10

package/scripts/build-daemon-packages.mjs

@@ -0,0 +1,210 @@
+#!/usr/bin/env node
+/**
+ * Publishes the four `failproofaid` binaries as npm platform packages, so a
+ * plain `npm install failproofai` already carries the daemon for the machine
+ * it landed on instead of fetching one from the GitHub Release later.
+ *
+ * The release assets stay exactly as they are — this is a second channel, not
+ * a replacement. `src/hooks/daemon-download.ts` prefers whichever binary is
+ * already on disk, then this npm package, then the release; the npm path is
+ * the only one that works with no network at `failproofai config` time.
+ *
+ * Two rules make this safe, and both come from the way the first attempt at
+ * npm-shipping the daemon failed (CHANGELOG 1.0.0-beta.3 — four
+ * `optionalDependencies` were declared and never published, so every install
+ * resolved four 404s):
+ *
+ *   1. These packages publish BEFORE the root package that pins them, so the
+ *      names always exist by the time anything depends on them.
+ *   2. A publish failure here is fatal, not a warning (unlike the alias stubs
+ *      in publish-aliases.mjs, where a missing name costs nothing). Failing
+ *      the job leaves the registry untouched; publishing a root package whose
+ *      optional dependency 404s would ship the broken state to every user.
+ *
+ * Usage:
+ *   node scripts/build-daemon-packages.mjs --artifacts <dir> [--dist-tag <tag>]
+ *                                          [--version <v>] [--pin-root] [--dry-run]
+ */
+import { execFileSync } from "node:child_process";
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { gunzipSync } from "node:zlib";
+import {
+  DAEMON_PLATFORMS,
+  daemonAssetName,
+  daemonOptionalDependencies,
+  daemonPackageName,
+} from "./daemon-platforms.mjs";
+
+const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+
+/**
+ * Where the generated packages are staged — **outside the repo**, and that is
+ * load-bearing rather than tidy.
+ *
+ * `npm publish` re-runs `prepare`, so the Next build happens again *after*
+ * this script has run, and Next's file tracing pulls the whole project root
+ * into `.next/standalone` (see the "over-traced project artifacts" prune list
+ * in scripts/prune-standalone.mjs). Anything staged inside the checkout
+ * therefore ends up inside the published CLI tarball — measured: a dry run
+ * shipped 16 MB of daemon `.gz` assets under
+ * `.next/standalone/release-assets/`. Staging in the temp dir cannot be swept
+ * up by a build. `--staging` overrides it for tests.
+ */
+export const STAGING_DIR = resolve(tmpdir(), "failproofaid-packages");
+
+/**
+ * The manifest for one platform package.
+ *
+ * Deliberately carries no `bin` (it would shadow the root package's own
+ * `failproofaid` shim, which is what a user invoking the daemon by hand
+ * should reach) and no `exports` (so `require.resolve("<pkg>/package.json")`
+ * — how the CLI finds this package — keeps working).
+ */
+export function platformPackageManifest(platform, version, rootPkg = {}) {
+  return {
+    name: daemonPackageName(platform.key),
+    version,
+    description: `The failproofaid background daemon binary for ${platform.os} ${platform.cpu}. Installed automatically as an optional dependency of failproofai.`,
+    // npm's own platform filters: with both set, only the matching package is
+    // installed and the other three are skipped without a warning.
+    os: [platform.os],
+    cpu: [platform.cpu],
+    files: ["bin/"],
+    publishConfig: { access: "public" },
+    repository: rootPkg.repository,
+    homepage: rootPkg.homepage,
+    bugs: rootPkg.bugs,
+    license: rootPkg.license,
+  };
+}
+
+/**
+ * Stages one platform package on disk and returns its directory.
+ *
+ * The binary is written decompressed and mode 0755: npm records the executable
+ * bit in the tarball, so it survives publish → install, which is how esbuild
+ * and swc ship their binaries.
+ */
+export function stagePlatformPackage(platform, version, rootPkg, artifactsDir, stagingRoot = STAGING_DIR) {
+  const asset = resolve(artifactsDir, daemonAssetName(platform.key));
+  if (!existsSync(asset)) {
+    throw new Error(`missing artifact ${asset} — the daemon build did not produce ${daemonAssetName(platform.key)}`);
+  }
+
+  const dir = join(stagingRoot, `failproofaid-${platform.key}`);
+  rmSync(dir, { recursive: true, force: true });
+  mkdirSync(join(dir, "bin"), { recursive: true });
+
+  const binary = gunzipSync(readFileSync(asset));
+  const binaryPath = join(dir, "bin", "failproofaid");
+  writeFileSync(binaryPath, binary);
+  chmodSync(binaryPath, 0o755);
+
+  writeFileSync(
+    join(dir, "package.json"),
+    JSON.stringify(platformPackageManifest(platform, version, rootPkg), null, 2) + "\n",
+  );
+  writeFileSync(
+    join(dir, "README.md"),
+    `# ${daemonPackageName(platform.key)}\n\n` +
+      `The \`failproofaid\` background daemon binary for ${platform.os} ${platform.cpu}.\n\n` +
+      `Installed automatically as an optional dependency of [failproofai](https://www.npmjs.com/package/failproofai) — ` +
+      `you do not need to install it yourself.\n`,
+  );
+
+  return dir;
+}
+
+/**
+ * Writes the four platform packages into the root manifest's
+ * `optionalDependencies`, pinned to `version`.
+ *
+ * Called at publish time rather than committed: a pin to a version that does
+ * not exist yet breaks `bun install --frozen-lockfile` in this repo's own CI,
+ * and keeping four pins in step with every version bump by hand is the drift
+ * this whole file exists to avoid.
+ */
+export function pinRootManifest(version, packageJsonPath = resolve(REPO_ROOT, "package.json")) {
+  const pkg = JSON.parse(readFileSync(packageJsonPath, "utf8"));
+  pkg.optionalDependencies = { ...pkg.optionalDependencies, ...daemonOptionalDependencies(version) };
+  writeFileSync(packageJsonPath, JSON.stringify(pkg, null, 2) + "\n");
+  return pkg.optionalDependencies;
+}
+
+function parseArgs(argv) {
+  const valueOf = (flag, fallback) => {
+    const index = argv.indexOf(flag);
+    return index !== -1 && argv[index + 1] ? argv[index + 1] : fallback;
+  };
+  return {
+    artifacts: valueOf("--artifacts", "release-assets"),
+    staging: valueOf("--staging", STAGING_DIR),
+    distTag: valueOf("--dist-tag", null),
+    version: valueOf("--version", null),
+    pinRoot: argv.includes("--pin-root"),
+    dryRun: argv.includes("--dry-run"),
+  };
+}
+
+/**
+ * `npm publish`, with provenance when the registry will take it.
+ *
+ * Provenance needs a supported CI and a repository field npm can match to the
+ * building workflow; when it refuses, the publish itself is still correct, so
+ * this retries once without the flag rather than failing the release.
+ */
+function publishPackage(dir, distTag, dryRun) {
+  const args = ["publish", "--tag", distTag];
+  if (dryRun) args.push("--dry-run");
+
+  const attempt = (extra) =>
+    execFileSync("npm", [...args, ...extra], { cwd: dir, stdio: "pipe", encoding: "utf8" });
+
+  const withProvenance = !dryRun && process.env.GITHUB_ACTIONS === "true";
+  try {
+    return attempt(withProvenance ? ["--provenance"] : []);
+  } catch (err) {
+    const output = (err.stdout ?? "") + (err.stderr ?? "");
+    if (output.includes("cannot publish over")) return "[skip] already published at this version";
+    if (withProvenance && /provenance/i.test(output)) {
+      console.log("::warning::provenance was rejected — retrying the publish without it");
+      return attempt([]);
+    }
+    // Fatal on purpose: see the header. The root package pins these names, so
+    // a half-published set must stop the release rather than ship 404s.
+    throw new Error(`npm publish failed for ${dir}:\n${output.trim()}`);
+  }
+}
+
+export function main(argv = process.argv.slice(2)) {
+  const options = parseArgs(argv);
+  const rootPkg = JSON.parse(readFileSync(resolve(REPO_ROOT, "package.json"), "utf8"));
+  const version = options.version ?? rootPkg.version;
+  const distTag = options.distTag ?? (version.includes("-") ? "beta" : "latest");
+  const artifactsDir = resolve(process.cwd(), options.artifacts);
+
+  console.log(
+    `Publishing ${DAEMON_PLATFORMS.length} failproofaid platform packages at ${version} ` +
+      `(tag: ${distTag}${options.dryRun ? ", dry run" : ""}) from ${artifactsDir}`,
+  );
+
+  for (const platform of DAEMON_PLATFORMS) {
+    const dir = stagePlatformPackage(platform, version, rootPkg, artifactsDir, options.staging);
+    const name = daemonPackageName(platform.key);
+    console.log(`\n${name}@${version}`);
+    console.log(publishPackage(dir, distTag, options.dryRun).trim());
+  }
+
+  if (options.pinRoot) {
+    const pins = pinRootManifest(version);
+    console.log("\nPinned in the root manifest's optionalDependencies:");
+    console.log(JSON.stringify(pins, null, 2));
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  main();
+}

package/scripts/daemon-platforms.mjs

@@ -0,0 +1,42 @@
+/**
+ * The platforms `failproofaid` is cross-compiled for, and the npm packages
+ * those binaries publish under.
+ *
+ * One list, three consumers: `build-daemon-packages.mjs` (publishes them),
+ * `publish-aliases.mjs` (pins them in every typo-squat stub), and the root
+ * package's injected `optionalDependencies`. They have to agree exactly — a
+ * name that appears in a dependency but never gets published is a 404 in
+ * every install, which is precisely how the first attempt at npm-shipping the
+ * daemon failed (see CHANGELOG 1.0.0-beta.3).
+ *
+ * `os` / `cpu` are npm's own filters, spelled in `process.platform` /
+ * `process.arch` values: with both set, npm and bun install only the package
+ * matching the machine and silently skip the other three.
+ */
+
+export const DAEMON_PLATFORMS = [
+  { key: "linux-x64", os: "linux", cpu: "x64" },
+  { key: "linux-arm64", os: "linux", cpu: "arm64" },
+  { key: "darwin-x64", os: "darwin", cpu: "x64" },
+  { key: "darwin-arm64", os: "darwin", cpu: "arm64" },
+];
+
+/** The npm package name carrying the binary for one platform key. */
+export function daemonPackageName(key) {
+  return `@failproofai/failproofaid-${key}`;
+}
+
+/** The release asset the binary for one platform key arrives in. */
+export function daemonAssetName(key) {
+  return `failproofaid-${key}.gz`;
+}
+
+/**
+ * The `optionalDependencies` block that pins all four platform packages to one
+ * version — what the root package and every alias stub carry when published.
+ */
+export function daemonOptionalDependencies(version) {
+  return Object.fromEntries(
+    DAEMON_PLATFORMS.map((platform) => [daemonPackageName(platform.key), version]),
+  );
+}

package/scripts/install-telemetry.mjs

@@ -86,12 +86,19 @@ function getInstanceId() {
  * fire from the CLI (see lib/install-check.ts) because package managers block
  * install scripts by default.
  *
+ * `opts.enabled` carries the resolved answer from lib/telemetry-enabled.ts. This
+ * file is a dependency-free .mjs so that it can run with no node_modules, which
+ * also means it cannot import the TOML config — so the caller, which can, passes
+ * the verdict in. Without it `[telemetry] enabled = false` would silence three
+ * dispatchers out of four and this one would keep reporting.
+ *
  * @param {string} event
  * @param {Record<string, unknown>} [properties]
- * @param {{ version?: string, timeoutMs?: number }} [opts]
+ * @param {{ version?: string, timeoutMs?: number, enabled?: boolean }} [opts]
  */
 export async function trackInstallEvent(event, properties = {}, opts = {}) {
   if (process.env.FAILPROOFAI_TELEMETRY_DISABLED === "1") return;
+  if (opts.enabled === false) return;
 
   const version = opts.version ?? process.env.npm_package_version ?? "unknown";
   const body = JSON.stringify({

package/scripts/launch.ts

@@ -10,22 +10,40 @@ import { parseScriptArgs } from "./parse-script-args";
 import { diagnoseShadow } from "./install-diagnosis.mjs";
 import { makeSkewLogFilter } from "./skew-log-filter";
 import { renderLaunchBanner } from "../src/hooks/tui";
+import { isLoopbackHostname, resolveDashboardHost } from "../lib/dashboard-host";
 import { version } from "../package.json";
 
 export function launch(mode: "dev" | "start"): void {
-  const { loggingLevel, disableTelemetry, allowedDevOrigins, remainingArgs } = parseScriptArgs(process.argv.slice(2));
+  const { loggingLevel, disableTelemetry, allowedDevOrigins, host, remainingArgs } = parseScriptArgs(process.argv.slice(2));
 
   // Branded splash — the same logomark + palette as the `configure` wizard, then
   // a tidy version/links column. Falls back to plain text off a TTY.
   for (const line of renderLaunchBanner(version)) console.log(line);
 
+  // The dashboard has no authentication and can toggle policies and uninstall
+  // hooks from every agent CLI, so it binds loopback unless someone asks
+  // otherwise. It used to bind 0.0.0.0 unconditionally, which handed all of
+  // that to every peer on the network.
+  const bindHost = resolveDashboardHost(host, process.env.FAILPROOFAI_DASHBOARD_HOST);
+  if (!isLoopbackHostname(bindHost)) {
+    console.warn(
+      `\n! Binding the dashboard to ${bindHost}, which is reachable from outside this machine.\n` +
+      `  It has no authentication: anyone who can reach it can read your session\n` +
+      `  transcripts, disable your policies, and uninstall failproofai's hooks.\n`,
+    );
+  }
+  // Read back by proxy.ts, which refuses any request whose Host is not one it
+  // should be answering to — the layer that stops DNS rebinding, which a
+  // loopback bind alone does not.
+  process.env.FAILPROOFAI_DASHBOARD_HOST = bindHost;
+
   let cmd: string;
   let cmdArgs: string[];
   if (mode === "start") {
     const portIdx = remainingArgs.indexOf("--port");
     const port = portIdx >= 0 ? remainingArgs[portIdx + 1] : "8020";
     process.env.PORT = port;
-    process.env.HOSTNAME = "0.0.0.0";
+    process.env.HOSTNAME = bindHost;
     cmd = "node";
     // Resolve the real package root via realpathSync so symlinked npm global binaries
     // don't cause import.meta.url to point at the symlink dir instead of the package dir.
@@ -74,7 +92,11 @@ export function launch(mode: "dev" | "start"): void {
     cmdArgs = [serverJsPath];
   } else {
     cmd = "bunx";
-    cmdArgs = ["--bun", "next", "dev", ...remainingArgs];
+    // `next dev` with no -H listens on every interface too, so dev gets the same
+    // default. Skipped when the caller already passed one through, so an
+    // explicit -H in remainingArgs still wins.
+    const hasHostFlag = remainingArgs.some((a) => a === "-H" || a === "--hostname" || a.startsWith("--hostname="));
+    cmdArgs = ["--bun", "next", "dev", ...(hasHostFlag ? [] : ["-H", bindHost]), ...remainingArgs];
   }
 
   // In `start` (the shipped standalone server) we pipe + filter the child's

package/scripts/parse-script-args.ts

@@ -7,6 +7,13 @@ export interface ParsedScriptArgs {
   loggingLevel: string | undefined;
   disableTelemetry: boolean;
   allowedDevOrigins: string[] | undefined;
+  /**
+   * Interface to bind the dashboard to. Undefined means the safe default
+   * (loopback) — see `resolveDashboardHost` in launch.ts. Only set this to a
+   * non-loopback address deliberately: the dashboard has no authentication and
+   * is a WRITE surface for this machine's security configuration.
+   */
+  host: string | undefined;
   remainingArgs: string[];
 }
 
@@ -32,6 +39,7 @@ export function parseScriptArgs(argv: string[]): ParsedScriptArgs {
   let loggingLevel: string | undefined;
   let disableTelemetry = false;
   let allowedDevOrigins: string[] | undefined;
+  let host: string | undefined;
 
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
@@ -71,7 +79,15 @@ export function parseScriptArgs(argv: string[]): ParsedScriptArgs {
       i--;
       continue;
     }
+
+    if (flag === "--host") {
+      const { value, spliceCount } = parseStringFlag(flag, "an address to bind (e.g. 127.0.0.1)", inlineValue, args, i);
+      host = value;
+      args.splice(i, spliceCount);
+      i--;
+      continue;
+    }
   }
 
-  return { loggingLevel, disableTelemetry, allowedDevOrigins, remainingArgs: args };
+  return { loggingLevel, disableTelemetry, allowedDevOrigins, host, remainingArgs: args };
 }

package/scripts/prune-standalone.mjs

@@ -101,6 +101,24 @@ const STANDALONE_ROOT_PRUNE = [
   ".claude", ".failproofai", ".github", ".vscode", ".idea",
   // Failproofai CLI artifacts — the dashboard never loads these
   "bin", "dist", "scripts", "src",
+  // Release-pipeline scratch: the daemon binaries downloaded from the build
+  // matrix and the staged platform packages. Both are written into the
+  // workspace only by a local/manual run (the publish workflow keeps them in
+  // RUNNER_TEMP precisely so this cannot happen), and 16 MB of `.gz` shipped
+  // inside the CLI tarball once already because nothing pruned them.
+  "release-assets", ".daemon-packages",
+  // The Rust workspace. `target/` is the big one: on any machine that has run
+  // `cargo build`, NFT traces it into the standalone output and it is FIFTEEN
+  // GIGABYTES of compiled artifacts — `npm pack` then hangs trying to tar it,
+  // which is how this was found. CI has not hit it because the Rust jobs build
+  // in a separate workspace, so nothing caught it; a contributor who builds the
+  // daemon and then the package hits it every time. The dashboard is a Next
+  // server — it never reads any of this.
+  "target", "crates",
+  // Test/dev trees NFT also over-traces. `integration-suite` is a harness, the
+  // plugin/extension dirs are shipped from the package root by `files`, not
+  // from inside the standalone bundle.
+  "integration-suite", "pi-extension", "openclaw-plugin", "docker-hook-sync",
 ];
 const STANDALONE_ROOT_PRUNE_FILES = [
   // Top-level markdown / licenses / docs
@@ -111,6 +129,14 @@ const STANDALONE_ROOT_PRUNE_FILES = [
   "vitest.config.mts", "vitest.config.e2e.mts",
   // Lockfiles
   "bun.lock", "bun.lockb", "package-lock.json", "yarn.lock",
+  // Rust workspace manifests, siblings of the `target`/`crates` prune above.
+  "Cargo.toml", "Cargo.lock", "rust-toolchain.toml", "osv-scanner.toml",
+  // 11 MB README animation. Traced because it sits in the repo root and is
+  // referenced from README.md; the running dashboard never serves it.
+  "readme-arch-hq.gif",
+  // Incremental typechecker state — regenerated on every build, read by nothing
+  // at runtime, and routinely a few hundred KB.
+  "tsconfig.tsbuildinfo", "next-env.d.ts", "postcss.config.mjs",
 ];
 for (const d of STANDALONE_ROOT_PRUNE) {
   rmSync(join(STANDALONE, d), { recursive: true, force: true });

package/scripts/publish-aliases.mjs

@@ -2,7 +2,8 @@
 import { execSync } from 'child_process';
 import { readFileSync, writeFileSync, mkdirSync, rmSync, cpSync } from 'fs';
 import { join, dirname } from 'path';
-import { fileURLToPath } from 'url';
+import { fileURLToPath, pathToFileURL } from 'url';
+import { daemonOptionalDependencies } from './daemon-platforms.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const rootPkg = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf8'));
@@ -11,7 +12,7 @@ const DRY_RUN = process.argv.includes('--dry-run');
 const distTagIdx = process.argv.indexOf('--dist-tag');
 const DIST_TAG = distTagIdx !== -1 ? process.argv[distTagIdx + 1] : (VERSION.includes('-') ? 'beta' : 'latest');
 
-const ALIASES = [
+export const ALIASES = [
   // Formatting variants — no "ai", or hyphen/underscore separators
   'failproof',
   'failproof-ai',
@@ -31,57 +32,77 @@ const ALIASES = [
   'faliproofai',
 ];
 
-const warnings = [];
-
-for (const name of ALIASES) {
-  const tmpDir = join('/tmp', `npm-alias-${name}-${Date.now()}`);
-  const binDir = join(tmpDir, 'bin');
-  mkdirSync(binDir, { recursive: true });
-
-  const pkg = {
+/**
+ * The manifest one alias stub publishes.
+ *
+ * The four `@failproofai/failproofaid-<platform>` pins are the same ones the
+ * root package carries. They arrive transitively through the `failproofai`
+ * dependency anyway, but naming them here means someone who installs a typo'd
+ * name gets the daemon binary for exactly the reason the root package does,
+ * rather than by accident of resolution — and a test can assert it.
+ */
+export function aliasManifest(name, version = VERSION, pkg = rootPkg) {
+  return {
     name,
-    version: VERSION,
+    version,
     description: `Alias for failproofai — installs if you typed '${name}' instead of 'failproofai'`,
     bin: { [name]: './bin/proxy.js' },
     files: ['bin/'],
-    dependencies: { failproofai: VERSION },
+    dependencies: { failproofai: version },
+    optionalDependencies: daemonOptionalDependencies(version),
     publishConfig: { access: 'public' },
-    repository: rootPkg.repository,
-    homepage: rootPkg.homepage,
-    bugs: rootPkg.bugs,
-    license: rootPkg.license,
+    repository: pkg.repository,
+    homepage: pkg.homepage,
+    bugs: pkg.bugs,
+    license: pkg.license,
   };
+}
 
-  writeFileSync(join(tmpDir, 'package.json'), JSON.stringify(pkg, null, 2) + '\n');
-  cpSync(join(__dirname, 'alias-proxy.js'), join(binDir, 'proxy.js'));
+export function main() {
+  const warnings = [];
 
-  if (DRY_RUN) {
-    console.log(`[dry-run] Would publish ${name}@${VERSION} (tag: ${DIST_TAG})`);
-    console.log(JSON.stringify(pkg, null, 2));
-    console.log('---');
-    rmSync(tmpDir, { recursive: true, force: true });
-    continue;
-  }
+  for (const name of ALIASES) {
+    const tmpDir = join('/tmp', `npm-alias-${name}-${Date.now()}`);
+    const binDir = join(tmpDir, 'bin');
+    mkdirSync(binDir, { recursive: true });
+
+    const pkg = aliasManifest(name);
 
-  console.log(`Publishing ${name}@${VERSION}...`);
-  try {
-    execSync(`npm publish --tag ${DIST_TAG}`, { cwd: tmpDir, stdio: 'pipe' });
-    console.log(`Done: ${name}`);
-  } catch (err) {
-    const output = (err.stdout?.toString() ?? '') + (err.stderr?.toString() ?? '');
-    if (output.includes('too similar')) {
-      warnings.push(`${name}: blocked by npm similarity check — request via npm support`);
-    } else if (output.includes('cannot publish over')) {
-      console.log(`[skip] ${name}: already published at ${VERSION}`);
-    } else {
-      warnings.push(`${name}: ${output.trim().split('\n').find(l => l.includes('npm error')) ?? 'unknown error'}`);
+    writeFileSync(join(tmpDir, 'package.json'), JSON.stringify(pkg, null, 2) + '\n');
+    cpSync(join(__dirname, 'alias-proxy.js'), join(binDir, 'proxy.js'));
+
+    if (DRY_RUN) {
+      console.log(`[dry-run] Would publish ${name}@${VERSION} (tag: ${DIST_TAG})`);
+      console.log(JSON.stringify(pkg, null, 2));
+      console.log('---');
+      rmSync(tmpDir, { recursive: true, force: true });
+      continue;
+    }
+
+    console.log(`Publishing ${name}@${VERSION}...`);
+    try {
+      execSync(`npm publish --tag ${DIST_TAG}`, { cwd: tmpDir, stdio: 'pipe' });
+      console.log(`Done: ${name}`);
+    } catch (err) {
+      const output = (err.stdout?.toString() ?? '') + (err.stderr?.toString() ?? '');
+      if (output.includes('too similar')) {
+        warnings.push(`${name}: blocked by npm similarity check — request via npm support`);
+      } else if (output.includes('cannot publish over')) {
+        console.log(`[skip] ${name}: already published at ${VERSION}`);
+      } else {
+        warnings.push(`${name}: ${output.trim().split('\n').find(l => l.includes('npm error')) ?? 'unknown error'}`);
+      }
     }
+
+    rmSync(tmpDir, { recursive: true, force: true });
   }
 
-  rmSync(tmpDir, { recursive: true, force: true });
+  if (warnings.length > 0) {
+    console.log('\n::warning::Some alias packages were not published:');
+    for (const w of warnings) console.log(`  - ${w}`);
+  }
 }
 
-if (warnings.length > 0) {
-  console.log('\n::warning::Some alias packages were not published:');
-  for (const w of warnings) console.log(`  - ${w}`);
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  main();
 }