pi-widget-host 0.3.3 → 0.3.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +23 -4
- package/README.md +5 -2
- package/docs/npm-publish-run-2026-07-04.md +118 -0
- package/docs/provider-example.md +35 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,13 +1,32 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
-
## Unreleased
|
|
4
|
-
|
|
5
|
-
- Add Buy Me a Coffee sponsor button to README and native GitHub funding link via `.github/FUNDING.yml`.
|
|
6
|
-
|
|
7
3
|
All notable changes to this project will be documented in this file.
|
|
8
4
|
|
|
9
5
|
This project follows semantic versioning.
|
|
10
6
|
|
|
7
|
+
## [0.3.5] - 2026-08-04
|
|
8
|
+
|
|
9
|
+
### Changed
|
|
10
|
+
|
|
11
|
+
- Bump package version for the Discord release webhook verification.
|
|
12
|
+
|
|
13
|
+
## [0.3.4] - 2026-07-21
|
|
14
|
+
|
|
15
|
+
### Added
|
|
16
|
+
|
|
17
|
+
- `ROADMAP.md` maintenance context for weekly portfolio seeds and bounded micro-tasks.
|
|
18
|
+
|
|
19
|
+
### Changed
|
|
20
|
+
|
|
21
|
+
- CONTRIBUTING release instructions now match the auto-release and publish workflow (no `follow-tags`).
|
|
22
|
+
- Dependency updates for `pi-widget-core` and development tooling.
|
|
23
|
+
|
|
24
|
+
## [0.3.3] - 2026-07-04
|
|
25
|
+
|
|
26
|
+
### Added
|
|
27
|
+
|
|
28
|
+
- Buy Me a Coffee sponsor button to README and native GitHub funding link via `.github/FUNDING.yml`.
|
|
29
|
+
|
|
11
30
|
## [0.3.2] - 2026-06-26
|
|
12
31
|
|
|
13
32
|
### Fixed
|
package/README.md
CHANGED
|
@@ -1,5 +1,7 @@
|
|
|
1
1
|
# Pi Widget Host
|
|
2
2
|
|
|
3
|
+
[](https://discord.gg/4945dXZVW5)
|
|
4
|
+
|
|
3
5
|
[](https://github.com/eiei114/pi-widget-host/actions/workflows/ci.yml)
|
|
4
6
|
[](https://github.com/eiei114/pi-widget-host/actions/workflows/publish.yml)
|
|
5
7
|
[](https://www.npmjs.com/package/pi-widget-host)
|
|
@@ -95,7 +97,7 @@ Future provider packages can publish to the host without importing this package
|
|
|
95
97
|
- required fields: `providerId`, `available`, `lines`, `updatedAt`
|
|
96
98
|
- optional fields: `priority`, `tags`, `mode`, `ttlMs`
|
|
97
99
|
|
|
98
|
-
See [`docs/protocol.md`](docs/protocol.md).
|
|
100
|
+
See [`docs/protocol.md`](docs/protocol.md) and the copy-paste [`minimal provider example`](docs/provider-example.md).
|
|
99
101
|
|
|
100
102
|
## Built-in demo provider
|
|
101
103
|
|
|
@@ -113,6 +115,7 @@ The built-in demo provider exists to prove the host loop first:
|
|
|
113
115
|
| `extensions/index.ts` | Pi extension entrypoint and `/widget-host:*` command registration |
|
|
114
116
|
| `lib/` | config store, registry protocol, policy evaluation, and demo provider |
|
|
115
117
|
| `docs/protocol.md` | registry protocol reference for future provider packages |
|
|
118
|
+
| `docs/provider-example.md` | minimal copy-paste provider publishing through the registry |
|
|
116
119
|
| `docs/release.md` | Trusted Publishing release notes |
|
|
117
120
|
|
|
118
121
|
## Development
|
|
@@ -150,4 +153,4 @@ For vulnerability reporting, see [`SECURITY.md`](SECURITY.md).
|
|
|
150
153
|
|
|
151
154
|
## License
|
|
152
155
|
|
|
153
|
-
MIT
|
|
156
|
+
MIT
|
|
@@ -0,0 +1,118 @@
|
|
|
1
|
+
# 2026-07-04 npm publish failure investigation
|
|
2
|
+
|
|
3
|
+
This records the failed `Publish to npm` workflow run without changing release workflows,
|
|
4
|
+
package versions, changelog entries, npm registry state, or releases.
|
|
5
|
+
|
|
6
|
+
## Failed run
|
|
7
|
+
|
|
8
|
+
- Run: <https://github.com/eiei114/pi-widget-host/actions/runs/28704568448>
|
|
9
|
+
- Workflow: `Publish to npm` (`.github/workflows/publish.yml`)
|
|
10
|
+
- Event: `workflow_dispatch`
|
|
11
|
+
- Selected ref / head branch: `v0.3.3`
|
|
12
|
+
- Checked-out object: tag `v0.3.3` -> commit `b7907bc48a57900b7e466a18e6a681184dcda797`
|
|
13
|
+
- Run attempt: `1`
|
|
14
|
+
- Started: `2026-07-04T11:20:24Z`
|
|
15
|
+
- Completed: `2026-07-04T11:20:56Z`
|
|
16
|
+
- Conclusion: `failure`
|
|
17
|
+
|
|
18
|
+
## Package and npm public state
|
|
19
|
+
|
|
20
|
+
- Package name at the failed ref: `pi-widget-host`
|
|
21
|
+
- Package version at the failed ref: `0.3.3`
|
|
22
|
+
- Current public npm state: `pi-widget-host@0.3.3` exists and is the `latest` dist-tag.
|
|
23
|
+
- `npm view pi-widget-host@0.3.3 version dist-tags time --json` reported:
|
|
24
|
+
- version: `0.3.3`
|
|
25
|
+
- latest: `0.3.3`
|
|
26
|
+
- `0.3.3` publish time: `2026-07-04T11:20:45.499Z`
|
|
27
|
+
|
|
28
|
+
## Failure output
|
|
29
|
+
|
|
30
|
+
The failed run validated and packed `pi-widget-host@0.3.3`, then the pre-publish guard
|
|
31
|
+
printed `Publishing pi-widget-host@0.3.3.` and allowed `npm publish --access public` to run.
|
|
32
|
+
The publish step failed with:
|
|
33
|
+
|
|
34
|
+
```text
|
|
35
|
+
npm error You cannot publish over the previously published versions: 0.3.3.
|
|
36
|
+
npm error A complete log of this run can be found in: /home/runner/.npm/_logs/2026-07-04T11_20_52_501Z-debug-0.log
|
|
37
|
+
Error: Process completed with exit code 1.
|
|
38
|
+
```
|
|
39
|
+
|
|
40
|
+
A concurrent successful run explains why the guard saw the version as unpublished but the
|
|
41
|
+
publish step then hit a duplicate version:
|
|
42
|
+
|
|
43
|
+
- Successful run: <https://github.com/eiei114/pi-widget-host/actions/runs/28704565106>
|
|
44
|
+
- Event/ref: `push` on `main`
|
|
45
|
+
- Commit: `b7907bc48a57900b7e466a18e6a681184dcda797`
|
|
46
|
+
- Started: `2026-07-04T11:20:16Z`
|
|
47
|
+
- `Publish to npm` step ran from `2026-07-04T11:20:42Z` to `2026-07-04T11:20:46Z`
|
|
48
|
+
- npm records `0.3.3` as published at `2026-07-04T11:20:45.499Z`
|
|
49
|
+
- The failed manual run's duplicate-version error occurred at `2026-07-04T11:20:54Z`
|
|
50
|
+
|
|
51
|
+
## Cause classification
|
|
52
|
+
|
|
53
|
+
Classification: **duplicate-version**.
|
|
54
|
+
|
|
55
|
+
The duplicate was caused by overlapping publish-eligible workflow runs for the same package
|
|
56
|
+
version. The automatic `push` run published `0.3.3`; the manual `workflow_dispatch` run on
|
|
57
|
+
`v0.3.3` reached `npm publish` seconds later and npm rejected publishing over an existing
|
|
58
|
+
version.
|
|
59
|
+
|
|
60
|
+
This is not currently classified as Trusted Publishing/authentication. The failed run had
|
|
61
|
+
`id-token: write`, installed a trusted-publishing-capable npm, and reached npm's duplicate
|
|
62
|
+
version validation rather than failing for provenance, OIDC, token, or permission reasons.
|
|
63
|
+
|
|
64
|
+
## Current workflow behavior
|
|
65
|
+
|
|
66
|
+
Current `.github/workflows/publish.yml` still allows multiple trigger paths to publish:
|
|
67
|
+
|
|
68
|
+
- `push` to `main` when package or workflow files change
|
|
69
|
+
- tag pushes matching `v*.*.*`
|
|
70
|
+
- published GitHub releases
|
|
71
|
+
- manual `workflow_dispatch` with an optional `ref`
|
|
72
|
+
|
|
73
|
+
The workflow has a duplicate-version guard using `npm view "${name}@${version}" version` and
|
|
74
|
+
skips only when that query succeeds before the publish step. It is useful for already-published
|
|
75
|
+
versions, but it is not an atomic lock: another run can publish the same version after the guard
|
|
76
|
+
checks and before `npm publish` runs.
|
|
77
|
+
|
|
78
|
+
The concurrency group is `npm-publish-${{ github.event.inputs.ref || github.ref }}`. For the
|
|
79
|
+
2026-07-04 overlap, the automatic run used a `main` ref while the manual run used `v0.3.3`, so
|
|
80
|
+
those two runs did not share a concurrency group even though both targeted `pi-widget-host@0.3.3`.
|
|
81
|
+
|
|
82
|
+
## Reproducible non-publish check
|
|
83
|
+
|
|
84
|
+
Use these read-only commands to reproduce the investigation without publishing:
|
|
85
|
+
|
|
86
|
+
```bash
|
|
87
|
+
gh run view 28704568448 \
|
|
88
|
+
--json event,headBranch,headSha,createdAt,updatedAt,conclusion,status,workflowName,url,jobs
|
|
89
|
+
|
|
90
|
+
gh run view 28704568448 --log-failed
|
|
91
|
+
|
|
92
|
+
gh run view 28704565106 \
|
|
93
|
+
--json event,headBranch,headSha,createdAt,updatedAt,conclusion,status,workflowName,url,jobs
|
|
94
|
+
|
|
95
|
+
npm view pi-widget-host@0.3.3 version dist-tags time --json
|
|
96
|
+
|
|
97
|
+
node -p "require('./package.json').name + '@' + require('./package.json').version"
|
|
98
|
+
npm pack --dry-run
|
|
99
|
+
```
|
|
100
|
+
|
|
101
|
+
`npm pack --dry-run` exercises package assembly only; it does not publish.
|
|
102
|
+
|
|
103
|
+
## Smallest safe correction options
|
|
104
|
+
|
|
105
|
+
No correction is applied in this investigation slice. Safe follow-up options, from smallest to
|
|
106
|
+
more opinionated, are:
|
|
107
|
+
|
|
108
|
+
1. Treat npm duplicate-version failures as a successful no-op when a post-failure `npm view
|
|
109
|
+
"${name}@${version}" version` confirms the same version is public. This preserves all current
|
|
110
|
+
triggers and makes publish races idempotent.
|
|
111
|
+
2. Change the concurrency group to a package-version-derived value after checkout, or otherwise
|
|
112
|
+
serialize all publish attempts that target the same `package.json` version. GitHub workflow-level
|
|
113
|
+
concurrency cannot directly read `package.json`, so this likely needs a small pre-publish lock
|
|
114
|
+
design rather than only editing the existing top-level group.
|
|
115
|
+
3. Reduce publish trigger overlap by making one path authoritative, such as publishing only from
|
|
116
|
+
release/tag events and keeping manual dispatch for recovery after maintainer review.
|
|
117
|
+
|
|
118
|
+
Any follow-up should remain release-owner approved because it changes release workflow behavior.
|
|
@@ -0,0 +1,35 @@
|
|
|
1
|
+
# Minimal provider example
|
|
2
|
+
|
|
3
|
+
Provider packages can publish widget lines without importing `pi-widget-host`. They only need to write a `ProviderEntry` into the process-local registry on `globalThis`.
|
|
4
|
+
|
|
5
|
+
```ts
|
|
6
|
+
const registrySymbol = Symbol.for("pi-widget-host.registry.v1");
|
|
7
|
+
|
|
8
|
+
type ProviderEntry = {
|
|
9
|
+
providerId: string;
|
|
10
|
+
available: boolean;
|
|
11
|
+
lines: string[];
|
|
12
|
+
updatedAt: string;
|
|
13
|
+
priority?: number;
|
|
14
|
+
tags?: string[];
|
|
15
|
+
mode?: string;
|
|
16
|
+
ttlMs?: number;
|
|
17
|
+
};
|
|
18
|
+
|
|
19
|
+
type WidgetHostRegistry = {
|
|
20
|
+
set(entry: ProviderEntry): void;
|
|
21
|
+
};
|
|
22
|
+
|
|
23
|
+
const registry = Reflect.get(globalThis, registrySymbol) as WidgetHostRegistry | undefined;
|
|
24
|
+
|
|
25
|
+
registry?.set({
|
|
26
|
+
providerId: "example.now-playing",
|
|
27
|
+
available: true,
|
|
28
|
+
lines: ["Now Playing", "Example Artist — Example Song"],
|
|
29
|
+
updatedAt: new Date().toISOString(),
|
|
30
|
+
priority: 20,
|
|
31
|
+
tags: ["music", "playing-now"],
|
|
32
|
+
});
|
|
33
|
+
```
|
|
34
|
+
|
|
35
|
+
Required fields are `providerId`, `available`, `lines`, and `updatedAt`. Optional fields such as `priority`, `tags`, `mode`, and `ttlMs` help the host choose between eligible providers. See [`protocol.md`](protocol.md) for the full registry shape and host selection notes.
|
package/package.json
CHANGED