loadout-ai 0.7.0 → 0.9.0

package/dist/src/commands/coordination-discussions.js

@@ -0,0 +1,194 @@
+import { formatDiscussion, getDiscussion, listDiscussions, requiredDiscussionTurns, runDiscussion, validateDiscussionOptions, } from "../core/coordination/discussion.js";
+import { SessionManager } from "../core/coordination/session-manager.js";
+import { createProviderAdapters } from "../core/coordination/runtime.js";
+import { acquireBridgeLease } from "../core/coordination/bridge-lease.js";
+import { parseProviderSessionRef, } from "./coordination-sessions.js";
+function assertBothProviders(values) {
+    if (values.length !== 2 ||
+        new Set(values).size !== 2 ||
+        !values.includes("claude-code") ||
+        !values.includes("codex")) {
+        throw new Error("A discussion requires exactly claude-code and codex, each once");
+    }
+}
+export function parseDiscussionAgents(value) {
+    const providers = value
+        .split(",")
+        .map((provider) => provider.trim())
+        .filter(Boolean);
+    assertBothProviders(providers);
+    return providers;
+}
+export function parseDiscussionSessions(values) {
+    if (values.length !== 2) {
+        throw new Error("A discussion requires exactly two provider sessions");
+    }
+    const sessions = values.map(parseProviderSessionRef);
+    assertBothProviders(sessions.map((session) => session.provider));
+    if (sessions[0].sessionId === sessions[1].sessionId) {
+        throw new Error("Discussion session IDs must be different");
+    }
+    return sessions;
+}
+export function resolveDiscussionSelection(options) {
+    if (options.agents && options.sessions) {
+        throw new Error("Choose either --agents or --sessions, not both");
+    }
+    if (!options.agents && !options.sessions) {
+        throw new Error("Discussion start requires --agents or --sessions");
+    }
+    const mode = options.agents ? "fresh" : "existing";
+    const selected = options.agents
+        ? parseDiscussionAgents(options.agents).map((provider) => ({
+            provider,
+        }))
+        : parseDiscussionSessions(options.sessions ?? []).map((session) => ({
+            provider: session.provider,
+            sessionId: session.sessionId,
+        }));
+    if (options.proposer) {
+        if (!selected.some((item) => item.provider === options.proposer)) {
+            throw new Error("--proposer must be claude-code or codex and be part of the discussion");
+        }
+        selected.sort((left) => (left.provider === options.proposer ? -1 : 1));
+    }
+    return { mode, participants: selected };
+}
+export function discussionTimeoutMs(seconds) {
+    if (!Number.isSafeInteger(seconds) || seconds < 10 || seconds > 600) {
+        throw new Error("Discussion timeout must be an integer between 10 and 600 seconds");
+    }
+    return seconds * 1_000;
+}
+/** Adapt a fresh or already-attached provider session to the discussion port. */
+export function createSessionParticipant(sessions, selection, role, cwd, timeoutMs) {
+    let sessionId = selection.sessionId;
+    return {
+        agent: selection.provider,
+        role,
+        async respond(prompt) {
+            if (!sessionId) {
+                const started = await sessions.startSession(selection.provider, cwd, prompt, timeoutMs);
+                sessionId = started.sessionId;
+            }
+            else {
+                const accepted = await sessions.submitTurn(sessionId, prompt, timeoutMs);
+                if (!accepted) {
+                    throw new Error(`${selection.provider}:${sessionId} rejected the discussion turn`);
+                }
+            }
+            return sessions.getLastResponse(sessionId) ?? "";
+        },
+    };
+}
+function createManager(projectRoot) {
+    return new SessionManager({
+        projectRoot,
+        adapters: createProviderAdapters(),
+        autoSubmit: false,
+    });
+}
+/** Register opt-in bounded provider discussions under `loadout coord discuss`. */
+export function registerCoordinationDiscussions(coord) {
+    const discuss = coord
+        .command("discuss")
+        .description("Bounded Claude Code ↔ Codex design discussions");
+    discuss
+        .command("list")
+        .description("List recorded design discussions without running an agent")
+        .option("--json", "machine-readable JSON output")
+        .action(async (options) => {
+        const discussions = await listDiscussions(process.cwd());
+        if (options.json) {
+            console.log(JSON.stringify(discussions, null, 2));
+        }
+        else if (discussions.length === 0) {
+            console.log("No design discussions recorded.");
+        }
+        else {
+            for (const thread of discussions) {
+                console.log(`${thread.threadId}  ${thread.status}  ${thread.participants.join(" ↔ ")}  ${thread.topic}`);
+            }
+        }
+    });
+    discuss
+        .command("show")
+        .description("Show one public discussion transcript without running an agent")
+        .argument("<thread-id>", "discussion thread ID")
+        .option("--json", "machine-readable JSON output")
+        .action(async (threadId, options) => {
+        const discussion = await getDiscussion(process.cwd(), threadId);
+        if (!discussion) {
+            throw new Error(`No discussion named '${threadId}'`);
+        }
+        console.log(options.json
+            ? JSON.stringify(discussion, null, 2)
+            : formatDiscussion(discussion));
+    });
+    discuss
+        .command("start")
+        .description("Run a bounded design discussion (spends paid provider turns)")
+        .argument("<topic>", "technical question for Claude Code and Codex")
+        .option("--agents <providers>", "start fresh sessions: claude-code,codex")
+        .option("--sessions <references...>", "reuse provider sessions: claude-code:<id> codex:<id>")
+        .option("--proposer <provider>", "claude-code or codex")
+        .option("--rounds <n>", "rounds; each agent speaks once per round", Number, 2)
+        .option("--max-turns <n>", "hard paid-turn budget", Number, 17)
+        .option("--timeout <seconds>", "timeout for each paid provider turn", Number, 120)
+        .option("--thread-id <id>", "stable discussion ID")
+        .option("--initiator <name>", "coordination identity starting the discussion", "user")
+        .option("--json", "machine-readable final output")
+        .action(async (topic, options) => {
+        const projectRoot = process.cwd();
+        const selection = resolveDiscussionSelection(options);
+        const timeoutMs = discussionTimeoutMs(options.timeout);
+        const noop = async () => "validated only";
+        validateDiscussionOptions({
+            topic,
+            rounds: options.rounds,
+            maxTurns: options.maxTurns,
+            participants: [
+                {
+                    agent: selection.participants[0].provider,
+                    role: "proposer",
+                    respond: noop,
+                },
+                {
+                    agent: selection.participants[1].provider,
+                    role: "reviewer",
+                    respond: noop,
+                },
+            ],
+        });
+        const plannedTurns = requiredDiscussionTurns(options.rounds);
+        console.error(`Starting bounded discussion: exactly ${plannedTurns} paid provider turns (${options.rounds} round(s) plus synthesis).`);
+        const lease = await acquireBridgeLease(projectRoot);
+        const sessions = createManager(projectRoot);
+        try {
+            await sessions.start();
+            if (selection.mode === "existing") {
+                for (const item of selection.participants) {
+                    await sessions.attachSession(item.provider, item.sessionId, projectRoot);
+                }
+            }
+            const result = await runDiscussion(projectRoot, {
+                topic,
+                rounds: options.rounds,
+                maxTurns: options.maxTurns,
+                ...(options.threadId ? { threadId: options.threadId } : {}),
+                initiatedBy: options.initiator,
+                participants: [
+                    createSessionParticipant(sessions, selection.participants[0], "proposer", projectRoot, timeoutMs),
+                    createSessionParticipant(sessions, selection.participants[1], "reviewer", projectRoot, timeoutMs),
+                ],
+            });
+            console.log(options.json
+                ? JSON.stringify(result, null, 2)
+                : formatDiscussion(result.state));
+        }
+        finally {
+            await sessions.stop();
+            await lease.release();
+        }
+    });
+}

package/dist/src/commands/coordination-sessions.js

@@ -0,0 +1,197 @@
+import { SessionManager } from "../core/coordination/session-manager.js";
+import { createProviderAdapters } from "../core/coordination/runtime.js";
+import { acquireBridgeLease } from "../core/coordination/bridge-lease.js";
+const SUPPORTED_PROVIDERS = new Set(["claude-code", "codex"]);
+export function parseProviderSessionRef(value) {
+    const separator = value.indexOf(":");
+    if (separator < 1) {
+        throw new Error(`Invalid session reference '${value}'; expected provider:session-id`);
+    }
+    const provider = value.slice(0, separator);
+    const sessionId = value.slice(separator + 1).trim();
+    if (!SUPPORTED_PROVIDERS.has(provider)) {
+        throw new Error(`Unsupported provider '${provider}'; supported providers: claude-code, codex`);
+    }
+    if (!sessionId) {
+        throw new Error(`Invalid session reference '${value}'; session id is empty`);
+    }
+    return { provider, sessionId };
+}
+function manager(projectRoot, autoSubmit, maxAutoTurnsPerSession = 20) {
+    return new SessionManager({
+        projectRoot,
+        adapters: createProviderAdapters(),
+        autoSubmit,
+        maxAutoTurnsPerSession,
+        onPendingEvents(session, events) {
+            console.error(`Could not route ${events.length} event(s) to ${session.provider}:${session.sessionId}; the session may be busy or unavailable.`);
+        },
+        ...(autoSubmit
+            ? {
+                onTurnCompleted(session, response) {
+                    console.log(`\n[${session.provider}:${session.sessionId}] ${response ?? "Coordination turn completed."}`);
+                },
+            }
+            : {}),
+    });
+}
+async function withStoppedManager(projectRoot, operation) {
+    const sessions = manager(projectRoot, false);
+    await sessions.start();
+    try {
+        return await operation(sessions);
+    }
+    finally {
+        await sessions.stop();
+    }
+}
+/** Register opt-in provider-driven turns under `loadout coord agents`. */
+export function registerCoordinationSessions(coord) {
+    const agents = coord
+        .command("agents")
+        .description("Bridge provider sessions so coordination events become follow-up turns (beta)");
+    agents
+        .command("detect")
+        .description("Detect supported provider runtimes")
+        .option("--json", "machine-readable JSON output")
+        .action(async (options) => {
+        const providers = await withStoppedManager(process.cwd(), async (sessions) => sessions.detectProviders());
+        if (options.json) {
+            console.log(JSON.stringify(providers, null, 2));
+        }
+        else if (providers.length === 0) {
+            console.log("No supported provider runtimes detected.");
+        }
+        else {
+            for (const provider of providers) {
+                console.log(`${provider.provider}: ${provider.version}`);
+            }
+        }
+    });
+    agents
+        .command("list")
+        .description("List sessions tracked by this project")
+        .option("--json", "machine-readable JSON output")
+        .action(async (options) => {
+        const tracked = await withStoppedManager(process.cwd(), async (sessions) => sessions.getSessions());
+        if (options.json) {
+            console.log(JSON.stringify(tracked, null, 2));
+        }
+        else if (tracked.length === 0) {
+            console.log("No provider sessions tracked for this project.");
+        }
+        else {
+            for (const session of tracked) {
+                console.log(`${session.provider}:${session.sessionId}  cursor=${session.cursor}  ${session.active ? "active" : "detached"}`);
+            }
+        }
+    });
+    agents
+        .command("start")
+        .description("Start and track a provider session (runs a paid agent turn)")
+        .argument("<provider>", "claude-code or codex")
+        .argument("[prompt...]", "initial task prompt")
+        .option("--json", "machine-readable JSON output")
+        .action(async (provider, prompt, options) => {
+        if (!SUPPORTED_PROVIDERS.has(provider)) {
+            throw new Error(`Unsupported provider '${provider}'; use claude-code or codex`);
+        }
+        const result = await withStoppedManager(process.cwd(), async (sessions) => {
+            const session = await sessions.startSession(provider, process.cwd(), prompt.join(" "));
+            return {
+                session,
+                response: sessions.getLastResponse(session.sessionId),
+            };
+        });
+        const { session, response } = result;
+        if (options.json) {
+            console.log(JSON.stringify({ session, response }, null, 2));
+        }
+        else {
+            console.log(`Started ${provider}:${session.sessionId}`);
+            if (response)
+                console.log(`\n${response}`);
+            console.log(`Keep it live with: loadout coord agents bridge ${provider}:${session.sessionId}`);
+        }
+    });
+    agents
+        .command("attach")
+        .description("Track an existing provider session without running a turn")
+        .argument("<session>", "provider:session-id")
+        .option("--json", "machine-readable JSON output")
+        .action(async (reference, options) => {
+        const parsed = parseProviderSessionRef(reference);
+        const session = await withStoppedManager(process.cwd(), async (sessions) => sessions.attachSession(parsed.provider, parsed.sessionId, process.cwd()));
+        if (options.json) {
+            console.log(JSON.stringify(session, null, 2));
+        }
+        else {
+            console.log(`Attached ${parsed.provider}:${parsed.sessionId}`);
+        }
+    });
+    agents
+        .command("send")
+        .description("Send one follow-up turn to a tracked provider session")
+        .argument("<session-id>", "tracked provider session id")
+        .argument("<message...>", "follow-up message")
+        .option("--json", "machine-readable JSON output")
+        .action(async (sessionId, message, options) => {
+        const result = await withStoppedManager(process.cwd(), async (sessions) => {
+            const tracked = sessions
+                .getSessions()
+                .find((session) => session.sessionId === sessionId);
+            if (!tracked) {
+                throw new Error(`Session ${sessionId} is not tracked; use 'loadout coord agents attach provider:${sessionId}' first`);
+            }
+            await sessions.resumeSession(tracked.provider, tracked.sessionId, process.cwd());
+            const sent = await sessions.submitTurn(sessionId, message.join(" "));
+            return {
+                sent,
+                response: sessions.getLastResponse(sessionId),
+            };
+        });
+        if (!result.sent) {
+            throw new Error(`Provider session ${sessionId} did not accept the turn`);
+        }
+        if (options.json) {
+            console.log(JSON.stringify({
+                sent: true,
+                sessionId,
+                response: result.response,
+            }));
+        }
+        else {
+            console.log(`Sent follow-up turn to ${sessionId}`);
+            if (result.response)
+                console.log(`\n${result.response}`);
+        }
+    });
+    agents
+        .command("bridge")
+        .description("Keep sessions connected and route coordination events as follow-up turns")
+        .argument("<sessions...>", "one or more provider:session-id references")
+        .option("--max-turns <n>", "maximum automatic turns per session before pausing", Number, 20)
+        .action(async (references, options) => {
+        const projectRoot = process.cwd();
+        const lease = await acquireBridgeLease(projectRoot);
+        const sessions = manager(projectRoot, true, options.maxTurns);
+        try {
+            await sessions.start();
+            for (const reference of references) {
+                const parsed = parseProviderSessionRef(reference);
+                await sessions.attachSession(parsed.provider, parsed.sessionId, projectRoot);
+            }
+            console.log(`Bridge active for ${references.join(", ")}. Coordination events will be delivered at safe turn boundaries.`);
+            console.log("Press Ctrl+C to stop.");
+            await new Promise((resolve) => {
+                const stop = () => resolve();
+                process.once("SIGINT", stop);
+                process.once("SIGTERM", stop);
+            });
+        }
+        finally {
+            await sessions.stop();
+            await lease.release();
+        }
+    });
+}

package/dist/src/commands/inventory.js

@@ -47,7 +47,7 @@ export function registerInventory(program) {
             force: options.force,
             onProgress: (message) => console.log(`→ ${message}`),
         });
-        console.log(`Removed ${result.removedPackages} managed package(s), ${result.removedRuntimeTools} runtime tool(s), daily jobs, cache, library, and Loadout state.`);
+        console.log(`Removed ${result.removedPackages} managed package(s), ${result.removedRuntimeTools} runtime tool(s), ${result.removedFirstPartySkills} first-party skill install(s), daily jobs, cache, library, and Loadout state.`);
         if (options.removeCli) {
             await uninstallGlobalCli();
             console.log("Removed the global loadout-ai CLI. Open a new shell before checking the command again.");
@@ -215,7 +215,9 @@ export function registerInventory(program) {
         });
         console.log(options.json
             ? JSON.stringify({ plan, result }, null, 2)
-            : `${formatReconcilePlan(plan)}\n\nReconciled ${result.adopted} exact group(s) and ${result.updated} outdated group(s). Snapshot: ${result.snapshotId}`);
+            : result.snapshotId
+                ? `${formatReconcilePlan(plan)}\n\nReconciled ${result.adopted} exact group(s) and ${result.updated} outdated group(s). Snapshot: ${result.snapshotId}`
+                : `${formatReconcilePlan(plan)}\n\nNothing to reconcile. No snapshot was needed.`);
     });
     program
         .command("adopt")

package/dist/src/core/agents/agent-inspection.js

@@ -136,6 +136,30 @@ export async function inspectAgent(agent) {
 export async function inspectAgents(agents) {
     return Promise.all(agents.map(inspectAgent));
 }
+/**
+ * Count installable units rather than raw filesystem entries. A skill is one
+ * directory containing SKILL.md, so counting every nested file reports a number
+ * many times larger than the number of skills the user actually has.
+ */
+export function countComponentUnits(component) {
+    if (!component.scanned || !component.directoryExists)
+        return 0;
+    const skillRoots = new Set();
+    let looseFiles = 0;
+    for (const entry of component.entries) {
+        if (entry.kind !== "file")
+            continue;
+        const segments = entry.path.split("/");
+        const name = segments[segments.length - 1];
+        if (name === "SKILL.md") {
+            // Depth 1 means SKILL.md sits at the component root, which is one unit.
+            skillRoots.add(segments.slice(0, -1).join("/") || ".");
+        }
+        else if (segments.length === 1)
+            looseFiles += 1;
+    }
+    return skillRoots.size || looseFiles;
+}
 /**
  * One agent's inventory. The default is a two-line summary: what is installed
  * and which component kinds the adapter supports. Adapter internals — the
@@ -155,16 +179,14 @@ export function formatAgentInventory(inventory, options = {}) {
         }
     }
     else {
-        const items = inventory.components
-            .filter((component) => component.scanned && component.directoryExists)
-            .reduce((total, component) => total + component.entries.length, 0);
+        const items = inventory.components.reduce((total, component) => total + countComponentUnits(component), 0);
         const supported = inventory.components
             .filter((component) => component.compatibility !== "unsupported")
             .map((component) => component.type);
         const skills = inventory.components.find((component) => component.type === "skill");
         if (skills?.directory)
             lines.push(`  ${skills.directory}`);
-        lines.push(`  ${items} items | supports: ${supported.join(", ")}`);
+        lines.push(`  ${items} skills | supports: ${supported.join(", ")}`);
     }
     for (const warning of inventory.warnings)
         lines.push(`  ! ${warning}`);

package/dist/src/core/{routing → agents}/model-config.js

@@ -5,6 +5,7 @@ import { formatSchemaError, providerModelConfigurationSchema, } from "../../shar
 import { writeFileAtomically } from "../install/atomic-file.js";
 import { ensureDirectory, loadoutHome } from "../agents/paths.js";
 import { runMutationTransaction } from "../install/transaction.js";
+import { boundedJson } from "../runtime/bounded-json.js";
 export const defaultModelConfigurationPath = () => join(loadoutHome(), "models.json");
 /**
  * Validate a portable, provider-neutral model configuration. This is not a
@@ -87,7 +88,7 @@ export async function requestOpenRouter(configuration, selectionId, messages, op
     const token = await options.resolveCredential(selection.credential);
     if (!token)
         throw new Error("OpenRouter credential reference did not resolve");
-    const response = await (options.fetcher ?? fetch)(`${selection.endpoint.replace(/\/$/, "")}/chat/completions`, {
+    const { response, value } = await boundedJson(options.fetcher ?? fetch, `${selection.endpoint.replace(/\/$/, "")}/chat/completions`, {
         method: "POST",
         headers: {
             accept: "application/json",
@@ -95,8 +96,12 @@ export async function requestOpenRouter(configuration, selectionId, messages, op
             authorization: `Bearer ${token}`,
         },
         body: JSON.stringify({ model: selection.model, messages }),
+    }, {
+        timeoutMs: 30_000,
+        maxBytes: 8 * 1024 * 1024,
+        label: "OpenRouter",
     });
     if (!response.ok)
         throw new Error(`OpenRouter request failed (${response.status})`);
-    return response.json();
+    return value;
 }

package/dist/src/core/catalog/catalog.js

@@ -14,6 +14,7 @@ function bundledCatalogPath() {
     const candidates = [
         join(moduleDirectory, "..", "..", "catalog", "packages.json"),
         join(moduleDirectory, "..", "..", "..", "catalog", "packages.json"),
+        join(moduleDirectory, "..", "..", "..", "..", "catalog", "packages.json"),
         join(process.cwd(), "catalog", "packages.json"),
     ];
     return candidates.find((candidate) => existsSync(candidate)) ?? candidates[0];

package/dist/src/core/catalog/registry.js

@@ -1,9 +1,12 @@
-import { createHash } from "node:crypto";
-import { cp, lstat, mkdir, readFile, readdir, rm, writeFile, } from "node:fs/promises";
+import { createHash, randomUUID } from "node:crypto";
+import { cp, lstat, mkdir, readFile, readdir, rename, rm, writeFile, } from "node:fs/promises";
 import { join, relative, resolve, sep } from "node:path";
 import { loadoutHome } from "../agents/paths.js";
+import { boundedJson } from "../runtime/bounded-json.js";
 import { analyzeUpdateSafety } from "./safety.js";
 const NAME = /^[a-z0-9][a-z0-9._-]*$/;
+/** A SHA-256 digest, and nothing that could traverse a path. */
+const DIGEST = /^[a-f0-9]{64}$/;
 const VERSION = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?$/;
 export function parsePackageDescriptor(value) {
     if (!value || typeof value !== "object")
@@ -266,18 +269,39 @@ function registryEndpoint(base, path) {
     endpoint.hash = "";
     return endpoint;
 }
+/** Registry responses are untrusted input: bound the wait and the body. */
+const REGISTRY_TIMEOUT_MS = 30_000;
+const REGISTRY_MAX_BYTES = 32 * 1024 * 1024;
+async function registryJson(input, init = {}) {
+    const { response, value } = await boundedJson(fetch, input, init, {
+        timeoutMs: REGISTRY_TIMEOUT_MS,
+        maxBytes: REGISTRY_MAX_BYTES,
+        label: "Remote registry",
+    });
+    return { ok: response.ok, status: response.status, value };
+}
 export async function fetchRemoteRegistryPackage(registry, name, version) {
     if (!NAME.test(name) || !VERSION.test(version))
         throw new Error("Invalid remote registry package name or version");
     const base = registryUrl(registry);
-    const response = await fetch(registryEndpoint(base, `/v1/packages/${encodeURIComponent(name)}/${encodeURIComponent(version)}`));
+    const response = await registryJson(registryEndpoint(base, `/v1/packages/${encodeURIComponent(name)}/${encodeURIComponent(version)}`));
     if (!response.ok)
         throw new Error(`Remote registry returned ${response.status}`);
-    const bundle = (await response.json());
+    const bundle = response.value;
+    // `digest` arrives from a remote server and is used to build a path that is
+    // later deleted recursively. Validate its shape before it can become one:
+    // a value such as "../../.." would otherwise escape the cache root.
+    if (typeof bundle?.digest !== "string" || !DIGEST.test(bundle.digest))
+        throw new Error("Remote registry returned a bundle whose digest is not a SHA-256 hex string");
     const key = createHash("sha256")
         .update(base.origin + base.pathname)
         .digest("hex");
-    const target = join(loadoutHome(), "cache", "registry", key, name, version, bundle.digest);
+    const root = join(loadoutHome(), "cache", "registry", key, name, version);
+    const target = resolve(root, bundle.digest);
+    // Belt and braces: even with a validated digest, never operate on a path
+    // that resolved outside the directory it was meant to live in.
+    if (target !== root && !target.startsWith(root + sep))
+        throw new Error("Remote registry bundle resolved outside the cache root");
     try {
         const packed = await packPackage(target);
         if (packed.digest === bundle.digest)
@@ -286,9 +310,19 @@ export async function fetchRemoteRegistryPackage(registry, name, version) {
     catch {
         /* import below */
     }
-    await mkdir(resolve(target, ".."), { recursive: true });
-    await rm(target, { recursive: true, force: true });
-    await importRegistryBundle(bundle, target);
+    // Import into a scratch directory and swap it in, so a failed or malicious
+    // import cannot leave the cache holding a half-written package.
+    await mkdir(root, { recursive: true });
+    const staging = `${target}.incoming-${randomUUID().slice(0, 8)}`;
+    try {
+        await importRegistryBundle(bundle, staging);
+        await rm(target, { recursive: true, force: true });
+        await rename(staging, target);
+    }
+    catch (error) {
+        await rm(staging, { recursive: true, force: true });
+        throw error;
+    }
     return { path: target, digest: bundle.digest };
 }
 export async function publishRemotePackage(root, registry, token, options = {}) {
@@ -296,7 +330,7 @@ export async function publishRemotePackage(root, registry, token, options = {})
         throw new Error("Remote registry token is required");
     const bundle = await createRegistryBundle(root);
     const base = registryUrl(registry);
-    const response = await fetch(registryEndpoint(base, "/v1/packages"), {
+    const response = await registryJson(registryEndpoint(base, "/v1/packages"), {
         method: "POST",
         headers: {
             authorization: `Bearer ${token}`,
@@ -305,7 +339,7 @@ export async function publishRemotePackage(root, registry, token, options = {})
         },
         body: JSON.stringify(bundle),
     });
-    const result = (await response.json());
+    const result = response.value;
     if (!response.ok)
         throw new Error(result.error ?? `Remote registry returned ${response.status}`);
     return {