opencode-harness-kit 0.3.8 → 0.4.0

package/CHANGELOG.md

@@ -14,6 +14,62 @@ is not happening.
 
 ## [Unreleased]
 
+## [0.4.0] — 2026-10-20
+
+### Fixed
+
+- **The create could not be completed at all.** npm prints the two-factor
+  challenge as `auth/cli/***` - masked - in text mode, and only puts the URL
+  that can be opened in the JSON body. The list asked for JSON and worked; the
+  create did not, and failed with a message that said nothing about why. Every
+  npm trust call asks for JSON now.
+- **Each npm command gets its own two-factor challenge.** The code a browser
+  flow returns is valid for the challenge that asked for it and for nothing
+  else, so carrying one from one command to the next made the second command
+  send a code that was already spent - and the registry answered that with a
+  different challenge, one that wants an authenticator code rather than a
+  browser. The failure looked like "npm wants something else now" and nothing
+  like the cause.
+- **The URLs come from the response body, not from a guess.** The done URL
+  was rebuilt from the id, which sent a real request to the registry with a
+  made-up id; the registry answered "forbidden", which is not a token, so the
+  wait ran its full length and then reported that nobody had answered.
+- **`OC_TRUST_NO_BROWSER` turns the browser off.** A test that opens a
+  browser on the machine it runs on is a test that breaks whatever the
+  person at the keyboard was doing.
+
+### The release path, end to end
+
+The publish is now automatic and holds no secret:
+
+- The tag triggers the workflow; the tests run; the publish job exchanges the
+  runner's OIDC identity for a short-lived publish token, so there is no npm
+  token in the repository to leak, rotate or expire.
+- A token still works when `NPM_TOKEN` is set, for the case where OIDC is not
+  configured.
+- `oc-harness trust` sets the trusted publisher up, and completes the
+  two-factor challenge in a browser - which works with an authenticator app, a
+  security key, or a code sent to the email.
+
+## [0.3.9] — 2026-10-20
+
+### Fixed
+
+- **Each npm command gets its own two-factor challenge.** The code a browser
+  flow returns is valid for the challenge that asked for it and for nothing
+  else, so carrying one from one command to the next made the second command
+  send a code that was already spent - and the registry answered that with a
+  different challenge, one that wants an authenticator code rather than a
+  browser. The failure looked like "npm wants something else now" and nothing
+  like the cause.
+- **The URLs come from the response body, not from a guess.** The done URL
+  was rebuilt from the id, which sent a real request to the registry with a
+  made-up id; the registry answered "forbidden", which is not a token, so the
+  wait ran its full length and then reported that nobody had answered.
+- **`OC_TRUST_NO_BROWSER` turns the browser off.** A test that opens a
+  browser on the machine it runs on is a test that breaks whatever the
+  person at the keyboard was doing.
+
 ## [0.3.8] — 2026-10-20
 
 ### Fixed
@@ -358,7 +414,9 @@ silent in the worst way:
 
 ---
 
-[Unreleased]: https://github.com/pham-canh/space-harness/compare/v0.3.8...HEAD
+[Unreleased]: https://github.com/pham-canh/space-harness/compare/v0.4.0...HEAD
+[0.4.0]: https://github.com/pham-canh/space-harness/compare/v0.3.9...v0.4.0
+[0.3.9]: https://github.com/pham-canh/space-harness/compare/v0.3.8...v0.3.9
 [0.3.8]: https://github.com/pham-canh/space-harness/compare/v0.3.7...v0.3.8
 [0.3.7]: https://github.com/pham-canh/space-harness/compare/v0.3.6...v0.3.7
 [0.3.6]: https://github.com/pham-canh/space-harness/compare/v0.3.5...v0.3.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-harness-kit",
-  "version": "0.3.8",
+  "version": "0.4.0",
   "description": "Harness kit for OpenCode: capability profiles, a fleet of job lanes with one free model each, role-based reasoning effort, context pruning, and measured baselines.",
   "license": "MIT",
   "homepage": "https://github.com/pham-canh/space-harness#readme",

package/src/trust.js

@@ -87,11 +87,10 @@ function npm(args, opts = {}) {
  * Run npm with its output captured.
  *
  * @param {string[]} args
- * @param {{ otp?: string }} [state]
+ * @param {string[]} [extra] arguments to add, such as `--otp=<code>`
  * @returns {{ out: string, code: number }}
  */
-function npmCaptured(args, state = {}) {
-  const extra = state.otp ? [`--otp=${state.otp}`] : []
+function npmCaptured(args, extra = []) {
   const r = spawnSync("npm", [...args, ...extra], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"],
@@ -117,26 +116,49 @@ function npmCaptured(args, state = {}) {
  * it, and npm then gives up and prints a URL nobody can open. So the flow is
  * done here, where the URL can be recovered.
  *
+ * EACH CALL GETS ITS OWN CHALLENGE. The code a browser flow returns is valid
+ * for the challenge that asked for it and for nothing else, so carrying one
+ * from one npm command to the next makes the second command send a code that
+ * is already spent, and the registry answers that with a different challenge
+ * - one that wants an authenticator code rather than a browser.
+ *
  * @param {string[]} args
- * @param {{ otp?: string }} [state]
+ * @param {{ otp?: string }} [state] the user's own code, if they gave one
  * @returns {Promise<{ out: string, code: number }>}
  */
 async function npmWithOtp(args, state = {}) {
-  let result = npmCaptured(args, state)
+  // JSON, always. In text mode npm prints the challenge as
+  // `auth/cli/***` - masked - and the URL that can be opened is only in the
+  // JSON body. Without this flag the create cannot be completed at all, and
+  // the failure says nothing about why.
+  const withJson = args.includes("--json") ? [] : ["--json"]
+  const userOtp = state.otp ? [`--otp=${state.otp}`] : []
+  let result = npmCaptured([...args, ...withJson], userOtp)
   if (result.code === 0) return result
 
-  const m = /"doneUrl"\s*:\s*"[^"]*authId=([a-f0-9-]+)"/.exec(result.out)
-  if (!m) return result
-  const authId = m[1]
-  const authUrl = `https://www.npmjs.com/auth/cli/${authId}`
-  const doneUrl = `https://registry.npmjs.org/-/v1/done?authId=${authId}`
+  // The URLs come FROM the body, not from a guess. Guessing the done URL
+  // sends a real request to the registry with a made-up id, and the registry
+  // answers "forbidden" - which is not a token, so the wait runs its full
+  // length and then reports that nobody answered.
+  const done = /"doneUrl"\s*:\s*"([^"]+)"/.exec(result.out)
+  if (!done) return result
+  const doneUrl = done[1]
+  const auth = /"authUrl"\s*:\s*"([^"]+)"/.exec(result.out)
+  const authId = /authId=([a-f0-9-]+)/.exec(doneUrl)
+  const authUrl = auth ? auth[1] : `https://www.npmjs.com/auth/cli/${authId?.[1] ?? ""}`
 
   // Open it if this machine can. The URL is printed either way, because a
   // browser that cannot be opened here can be opened anywhere.
-  try {
-    execFileSync("xdg-open", [authUrl], { stdio: "ignore", timeout: 10_000 })
-  } catch {
-    // No browser here. The URL below is the way out.
+  //
+  // OC_TRUST_NO_BROWSER turns the opening off, which is what a test needs:
+  // a test that opens a browser on the machine it runs on is a test that
+  // breaks whatever the person at the keyboard was doing.
+  if (!process.env.OC_TRUST_NO_BROWSER) {
+    try {
+      execFileSync("xdg-open", [authUrl], { stdio: "ignore", timeout: 10_000 })
+    } catch {
+      // No browser here. The URL below is the way out.
+    }
   }
   console.error("")
   console.error(bold("  npm needs to confirm it is you."))
@@ -151,8 +173,8 @@ async function npmWithOtp(args, state = {}) {
     console.error(red("  no answer came back, so nothing was changed."))
     return result
   }
-  state.otp = token
-  result = npmCaptured(args, state)
+  // The code is used for THIS call only.
+  result = npmCaptured([...args, ...withJson], [`--otp=${token}`])
   return result
 }