opencode-harness-kit 0.3.4 → 0.3.5

package/CHANGELOG.md

@@ -14,6 +14,16 @@ is not happening.
 
 ## [Unreleased]
 
+## [0.3.5] — 2026-10-20
+
+### Added
+
+- **`oc-harness trust`** configures npm trusted publishing from the command
+  line, and says which field is wrong when it is wrong. It works from any
+  directory: a release tool that only runs from one place is a release tool
+  that people run from the wrong one, and the failure is `Cannot read
+  package.json`, which says nothing about what the command was for.
+
 ## [0.3.4] — 2026-10-20
 
 > 0.3.2 and 0.3.3 were never published. 0.3.2 carried the fix below but the
@@ -294,7 +304,8 @@ silent in the worst way:
 
 ---
 
-[Unreleased]: https://github.com/pham-canh/space-harness/compare/v0.3.4...HEAD
+[Unreleased]: https://github.com/pham-canh/space-harness/compare/v0.3.5...HEAD
+[0.3.5]: https://github.com/pham-canh/space-harness/compare/v0.3.4...v0.3.5
 [0.3.4]: https://github.com/pham-canh/space-harness/compare/v0.3.1...v0.3.4
 [0.3.1]: https://github.com/pham-canh/space-harness/compare/v0.3.0...v0.3.1
 [0.3.0]: https://github.com/pham-canh/space-harness/compare/v0.2.1...v0.3.0

package/bin/oc-harness.mjs

@@ -46,6 +46,7 @@ import {
 import { generateConfig, globalInstructionsPath } from "../src/config.js"
 import { planEffort } from "../src/effort.js"
 import { findTelemetryFile, readLaneUsage, averageMs } from "../src/lane-usage.js"
+import { main as trustMain } from "../src/trust.js"
 
 const CONFIG_DIR =
   process.env.OPENCODE_CONFIG_DIR ?? join(homedir(), ".config/opencode")
@@ -1409,6 +1410,9 @@ try {
     case "lanes":
       cmdLanes()
       break
+    case "trust":
+      process.exitCode = trustMain(args.slice(1))
+      break
     case "doctor":
       await cmdDoctor()
       break
@@ -1433,6 +1437,7 @@ try {
     link          symlink the built plugin into ~/.config/opencode/plugins
     agents        report agents the effort tiering does not reach
     lanes         report which lanes the fleet actually used
+    trust         set up npm trusted publishing for this package
     doctor    re-check profiles against models.dev and the installed config
     baseline  measure the current opencode install
     run       drive .space/tasks.md to done with the build agent

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-harness-kit",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "Harness kit for OpenCode: capability profiles, a fleet of job lanes with one free model each, role-based reasoning effort, context pruning, and measured baselines.",
   "license": "MIT",
   "homepage": "https://github.com/pham-canh/space-harness#readme",
@@ -53,7 +53,7 @@
     "check": "npm run test:all && npm run test:install && node bin/oc-harness.mjs verify",
     "check:online": "npm run check && node bin/oc-harness.mjs doctor",
     "baseline": "node bin/baseline.mjs",
-    "release:trust": "node tools/setup-trusted-publishing.mjs",
+    "release:trust": "node bin/oc-harness.mjs trust",
     "eval": "node eval/run.mjs",
     "measure": "node eval/measure-install.mjs",
     "measure:check": "node eval/measure-install.mjs --min-narrow 45 --min-ctx-drop 20",

package/src/trust.js

@@ -0,0 +1,236 @@
+// Set up npm trusted publishing for this package, and say what is wrong with
+// it if it is wrong.
+//
+// Why this exists: npm's web form for a trusted publisher has four fields and
+// npm does not validate what you type - "npm does not verify your trusted
+// publisher configuration when you save it". A typo in any of them is
+// discovered at publish time, and npm reports it as:
+//
+//   OIDC token exchange error - package not found
+//
+// which reads like a missing package. The package is there. The configuration
+// is not matching, and npm does not say which field.
+//
+// So this compares what npm has stored against what the workflow will
+// actually present, and says which field differs. That is the whole job.
+//
+// Requirements npm itself states for these commands:
+//   - npm 11.15.0 or later
+//   - write access to the package
+//   - two-factor authentication enabled on the account
+//   - the package must already exist on the registry
+//
+// The root is resolved from THIS file, not from the working directory, so the
+// command works from anywhere - which matters, because a release tool that
+// only runs from one directory is a release tool that people run from the
+// wrong one.
+
+import { execFileSync } from "node:child_process"
+import { readFileSync } from "node:fs"
+import { dirname, join } from "node:path"
+import { fileURLToPath } from "node:url"
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..")
+
+/** @param {string} s */
+const bold = (s) => `\x1b[1m${s}\x1b[0m`
+/** @param {string} s */
+const red = (s) => `\x1b[31m${s}\x1b[0m`
+/** @param {string} s */
+const green = (s) => `\x1b[32m${s}\x1b[0m`
+/** @param {string} s */
+const yellow = (s) => `\x1b[33m${s}\x1b[0m`
+/** @param {string} s */
+const dim = (s) => `\x1b[2m${s}\x1b[0m`
+
+/**
+ * The repository in the `owner/repo` form npm wants.
+ *
+ * npm matches the trusted publisher's repository against the OIDC token's
+ * `repository` claim, which is `owner/repo` with no scheme and no `.git`. The
+ * `repository` field in package.json is a git URL, so it has to be reduced to
+ * that form - and getting it wrong is one of the ways a configuration ends up
+ * not matching.
+ *
+ * @param {any} repository
+ * @returns {string}
+ */
+export function repoOf(repository) {
+  const url = typeof repository === "string" ? repository : repository?.url ?? ""
+  const m = url.match(/github\.com[/:]([^/]+)\/([^/]+?)(?:\.git)?$/)
+  if (!m) throw new Error(`cannot read a GitHub repository out of ${JSON.stringify(repository)}`)
+  return `${m[1]}/${m[2]}`
+}
+
+/**
+ * Run npm and return its output.
+ *
+ * @param {string[]} args
+ * @param {{ allowFail?: boolean }} [opts]
+ * @returns {string}
+ */
+function npm(args, opts = {}) {
+  const allowFail = opts.allowFail === true
+  try {
+    return execFileSync("npm", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] })
+  } catch (err) {
+    if (allowFail) return ""
+    const e = /** @type {any} */ (err)
+    const detail = `${e.stdout ?? ""}${e.stderr ?? ""}`.trim()
+    console.error(red(`npm ${args.join(" ")} failed`))
+    if (detail) console.error(detail)
+    process.exit(1)
+  }
+}
+
+/**
+ * The stored trusted publisher configurations for this package.
+ * @param {string} name
+ * @returns {any[]}
+ */
+function listConfigs(name) {
+  const out = npm(["trust", "list", name, "--json"], { allowFail: true })
+  if (!out.trim()) return []
+  let parsed
+  try {
+    parsed = JSON.parse(out)
+  } catch {
+    return []
+  }
+  const items = Array.isArray(parsed) ? parsed : parsed.configs ?? [parsed]
+  return items.filter(Boolean)
+}
+
+/**
+ * The fields npm actually matches, in the shape npm stores them.
+ * @param {any} config
+ */
+function describe(config) {
+  const claims = config.claims ?? {}
+  const file = config.file ?? claims.workflow_ref?.file
+  const repository = config.repository ?? claims.repository
+  const environment = config.environment ?? claims.environment
+  const permissions = config.permissions ?? []
+  return { file, repository, environment, permissions }
+}
+
+/**
+ * @param {string[]} argv
+ * @returns {number} the exit code
+ */
+export function main(argv = []) {
+  const pkg = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8"))
+  const name = pkg.name
+  const repo = repoOf(pkg.repository)
+  const file = process.env.TRUSTED_PUBLISHER_FILE ?? "ci.yml"
+  const checkOnly = argv.includes("--check")
+
+  console.log(`\n${bold("npm trusted publishing")}  ${dim(`${name} · ${repo} · ${file}`)}\n`)
+
+  // 0. The preconditions npm states, checked before anything else.
+  const version = npm(["--version"]).trim()
+  const [major, minor] = version.split(".").map(Number)
+  if (major < 11 || (major === 11 && minor < 15)) {
+    console.error(red(`npm ${version} is too old for \`npm trust\`, which needs 11.15.0 or later.`))
+    console.error("  npm install -g npm@latest")
+    return 1
+  }
+  try {
+    npm(["whoami"])
+  } catch {
+    console.error(red("not logged in to the npm registry."))
+    console.error("  npm login")
+    return 1
+  }
+
+  const configs = listConfigs(name)
+
+  if (!configs.length) {
+    console.log(yellow("  no trusted publisher is configured for this package."))
+    console.log(dim("  The registry answers a publish from an unconfigured package with"))
+    console.log(dim("  'OIDC token exchange error - package not found', which reads like a"))
+    console.log(dim("  missing package. The package is there; nothing is configured.\n"))
+    if (checkOnly) {
+      console.log(dim("  run without --check to create it\n"))
+      return 1
+    }
+    console.log(`  creating it: ${file}, no environment, publish and stage\n`)
+    npm([
+      "trust",
+      "github",
+      name,
+      "--file",
+      file,
+      "--repo",
+      repo,
+      "--allow-publish",
+      "--allow-stage-publish",
+      "-y",
+    ])
+    console.log(`\n  ${green("✓")} the trusted publisher is configured\n`)
+    return 0
+  }
+
+  // 1. npm allows exactly one configuration per package, and it cannot be
+  //    edited - only revoked and replaced. So the comparison is against the
+  //    one that is stored.
+  for (const config of configs) {
+    const got = describe(config)
+    const problems = []
+    if (got.repository !== repo) {
+      problems.push(`repository is ${JSON.stringify(got.repository)}, expected ${JSON.stringify(repo)}`)
+    }
+    if (got.file !== file) {
+      problems.push(`workflow file is ${JSON.stringify(got.file)}, expected ${JSON.stringify(file)}`)
+    }
+    if (got.environment) {
+      problems.push(
+        `environment is ${JSON.stringify(got.environment)}, expected none - the workflow declares no environment, so a claim that is never sent can never match`,
+      )
+    }
+    if (!got.permissions.includes("createPackage")) {
+      problems.push(
+        `permissions are [${got.permissions.join(", ")}], expected createPackage - without it the configuration cannot publish`,
+      )
+    }
+
+    if (!problems.length) {
+      console.log(`  ${green("✓")} the stored configuration matches the workflow`)
+      console.log(dim(`    repository ${got.repository} · file ${got.file} · no environment`))
+      console.log(dim(`    permissions ${got.permissions.join(", ")}`))
+      console.log(`\n  ${green("nothing to do")}\n`)
+      return 0
+    }
+
+    console.log(yellow(`  the stored configuration does not match the workflow:`))
+    for (const p of problems) console.log(`    - ${p}`)
+    console.log("")
+    if (checkOnly) {
+      console.log(dim("  run without --check to replace it\n"))
+      return 1
+    }
+    console.log(dim("  npm allows one configuration per package and cannot edit it,"))
+    console.log(dim("  so it is revoked and replaced.\n"))
+    const id = config.id ?? config.trustId ?? config._id
+    if (!id) {
+      console.error(red("  the stored configuration has no id, so it cannot be revoked from here."))
+      console.error("  revoke it on npmjs.com and run this again.")
+      return 1
+    }
+    npm(["trust", "revoke", name, "--id", id, "-y"])
+    npm([
+      "trust",
+      "github",
+      name,
+      "--file",
+      file,
+      "--repo",
+      repo,
+      "--allow-publish",
+      "--allow-stage-publish",
+      "-y",
+    ])
+    console.log(`\n  ${green("✓")} the trusted publisher is configured\n`)
+  }
+  return 0
+}