session-peer 0.1.0-preview.1 → 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/README.ja.md +14 -8
  2. package/README.ko.md +23 -18
  3. package/README.md +26 -20
  4. package/README.zh-CN.md +14 -8
  5. package/RELEASING.md +103 -169
  6. package/VALIDATION.md +36 -8
  7. package/dist/protocol.d.ts +2 -2
  8. package/dist/protocol.js +1 -1
  9. package/package.json +3 -3
package/README.ja.md CHANGED
@@ -2,11 +2,11 @@
2
2
 
3
3
  [English](README.md) | [한국어](README.ko.md) | [日本語](README.ja.md) | [简体中文](README.zh-CN.md)
4
4
 
5
- <!-- docs-contract: preview-candidate; package=session-peer; bin=session-peer; node=22.13+/24; python-reference=1.0.2 -->
5
+ <!-- docs-contract: stable-release-source; package=session-peer; bin=session-peer; node=22.13+/24; python-reference=1.0.2 -->
6
6
 
7
7
  実行中の **Claude Code と Codex セッション**に、ローカルまたは SSH 経由でメッセージを送る TypeScript クライアントです。Node.js で動作し、Python は不要です。
8
8
 
9
- **プレビューのリリース候補であり、公開には別途承認が必要です。**パッケージ名は `session-peer`、CLI コマンドは **`session-peer`**。Relay サーバーやホスティングサービスは提供しません。
9
+ **0.1.0 安定版のリリースソースであり、公開には別途承認が必要です。**パッケージ名は `session-peer`、CLI コマンドは **`session-peer`**。Relay サーバーやホスティングサービスは提供しません。
10
10
 
11
11
  ## 機能と範囲
12
12
 
@@ -23,7 +23,7 @@ macOS / Linux / Windows native、Node **22.x の 22.13 以上、または 24.x**
23
23
 
24
24
  ## インストール
25
25
 
26
- 公式 npm リリースで所有権と来歴を確認するまでは、レジストリの `npm install -g session-peer` や `npx session-peer` を実行しないでください。現在はレビューしたソースをビルドし、必要ならローカル tarball をインストールします。
26
+ 検証済みの `0.1.0-preview.1` は公開されています。安定版の公開前にレビュー済みの `0.1.0` ソースを評価するには、ビルドして必要ならローカル tarball をインストールします。
27
27
 
28
28
  ```sh
29
29
  git clone https://github.com/abruption/session-peer-ts.git
@@ -33,17 +33,17 @@ npm run build
33
33
  node dist/cli.js --version
34
34
  npm pack --ignore-scripts
35
35
  # 任意のグローバルインストール前に PATH の既存コマンドを確認
36
- npm install --global --ignore-scripts ./session-peer-0.1.0-preview.1.tgz
36
+ npm install --global --ignore-scripts ./session-peer-0.1.0.tgz
37
37
  session-peer --version
38
38
  ```
39
39
 
40
- 期待値は `session-peer 0.1.0-preview.1 (typescript)`。`./...tgz` を省略しないでください。これは未確認のレジストリではなくローカル成果物を選択します。別途承認された npm 公開後も、パッケージ名とコマンド名は上記のままです。そのリリースのバージョン / dist-tag を確認してください。
40
+ 期待値は `session-peer 0.1.0 (typescript)`。`./...tgz` を省略せず、ローカルの候補を選択してください。安定版の承認と検証が完了するまでは、レジストリからのインストールに正確なバージョンを指定してください。
41
41
 
42
42
  ### 既存インストールとの共存
43
43
 
44
44
  インストール前後に `type -a session-peer` と `command -v session-peer` を確認します。他の実装も同名コマンドを提供するため、PATH 上の一つを選ぶか `node /absolute/path/dist/cli.js` を使ってください。`--force` で他の管理ツールのファイルを上書きしないでください。Python パッケージ・スキル・サービスを自動変更しません。削除は `npm uninstall --global session-peer` を使い、PATH を再確認します。
45
45
 
46
- Windows PowerShell では `Get-Command session-peer -All` で既存コマンドを確認します。Python CLI を置換せずに試すには、`npm ci --ignore-scripts`、`npm run build`、`npm pack --ignore-scripts` の後、`npm install --prefix "$env:TEMP\session-peer-ts-preview" --ignore-scripts .\session-peer-0.1.0-preview.1.tgz` を実行し、`& "$env:TEMP\session-peer-ts-preview\node_modules\.bin\session-peer.cmd" --version` で確認します。同じ prefix の `npm uninstall --prefix "$env:TEMP\session-peer-ts-preview" session-peer` で削除します。
46
+ Windows PowerShell では `Get-Command session-peer -All` で既存コマンドを確認します。Python CLI を置換せずに試すには、`npm ci --ignore-scripts`、`npm run build`、`npm pack --ignore-scripts` の後、`npm install --prefix "$env:TEMP\session-peer-ts-candidate" --ignore-scripts .\session-peer-0.1.0.tgz` を実行し、`& "$env:TEMP\session-peer-ts-candidate\node_modules\.bin\session-peer.cmd" --version` で確認します。同じ prefix の `npm uninstall --prefix "$env:TEMP\session-peer-ts-candidate" session-peer` で削除します。
47
47
 
48
48
  ## 使い方
49
49
 
@@ -99,14 +99,20 @@ Python は開発時の互換検証基準のみです（v1.0.2、`47c23713d0a2a3c
99
99
 
100
100
  ## npm 公開後のインストール
101
101
 
102
- 公式リリースとレジストリの整合性・provenance 検証が完了した後にのみ、次の正確なプレビューバージョンをインストールしてください。安定版 `latest` ではありません。公開前は上記のローカル tarball を使います。
102
+ 公開済みプレビューは、レジストリの整合性・provenance・署名・新規インストールの検証に合格しました。安定版への昇格前は、バージョンを指定しないインストールが `latest` の旧 `0.1.0-preview.0` を選ぶため、次の正確なバージョンを指定してください。
103
103
 
104
104
  ```sh
105
105
  npm install --global --ignore-scripts session-peer@0.1.0-preview.1
106
+ ```
107
+
108
+ 別途承認された `0.1.0` の staging が公開・検証された後、安定版を正確なバージョンでインストールしてください。
109
+
110
+ ```sh
111
+ npm install --global --ignore-scripts session-peer@0.1.0
106
112
  session-peer --version
107
113
  ```
108
114
 
109
- 手動ワークフローは初回のみ短期 bootstrap トークンを使用します。以後は Trusted Publisher OIDC で staging し、保守者が 2FA で承認します。staging 成功は公開完了ではありません。[RELEASING.md](RELEASING.md) を参照してください。
115
+ 手動ワークフローは Trusted Publisher OIDC で staging し、保守者が 2FA で承認します。staging 成功は公開完了ではありません。[RELEASING.md](RELEASING.md) を参照してください。
110
116
 
111
117
  ## 関連プロジェクト
112
118
 
package/README.ko.md CHANGED
@@ -2,12 +2,12 @@
2
2
 
3
3
  [English](README.md) | [한국어](README.ko.md) | [日本語](README.ja.md) | [简体中文](README.zh-CN.md)
4
4
 
5
- <!-- docs-contract: preview-candidate; package=session-peer; bin=session-peer; node=22.13+/24; python-reference=1.0.2 -->
5
+ <!-- docs-contract: stable-release-source; package=session-peer; bin=session-peer; node=22.13+/24; python-reference=1.0.2 -->
6
6
 
7
7
  실행 중인 **Claude Code·Codex 세션에 로컬 또는 SSH로 메시지를 전달**하는
8
8
  TypeScript 클라이언트입니다. Python 없이 Node.js로 실행합니다.
9
9
 
10
- **프리뷰 릴리스 후보이며 발행에는 별도 승인이 필요합니다.** 패키지명은
10
+ **0.1.0 안정판 릴리스 소스이며 발행에는 별도 승인이 필요합니다.** 패키지명은
11
11
  `session-peer`, CLI 명령어는 **`session-peer`**입니다. Relay 서버나 호스팅
12
12
  서비스를 제공하는 프로젝트가 아닙니다.
13
13
 
@@ -35,9 +35,9 @@ macOS/Linux/Windows native와 Node **22.x의 22.13 이상 또는 24.x**가 필
35
35
 
36
36
  ## 설치
37
37
 
38
- 공식 npm 릴리스에서 소유권·출처가 확인되기 전에는 레지스트리의
39
- `npm install -g session-peer`나 `npx session-peer`를 실행하지 마세요.
40
- 현재는 검토한 소스를 빌드하고, 필요할 때 로컬 tarball을 설치합니다.
38
+ 검증된 `0.1.0-preview.1`은 공개됐습니다. 안정판 발행 전에 검토한
39
+ `0.1.0` 소스를 평가하려면 소스를 빌드하고 필요한 경우
40
+ 로컬 tarball을 설치합니다.
41
41
 
42
42
  ```sh
43
43
  git clone https://github.com/abruption/session-peer-ts.git
@@ -47,14 +47,13 @@ npm run build
47
47
  node dist/cli.js --version
48
48
  npm pack --ignore-scripts
49
49
  # 선택 사항: PATH에서 사용할 구현을 명시적으로 선택한 뒤 전역 설치
50
- npm install --global --ignore-scripts ./session-peer-0.1.0-preview.1.tgz
50
+ npm install --global --ignore-scripts ./session-peer-0.1.0.tgz
51
51
  session-peer --version
52
52
  ```
53
53
 
54
- 예상 출력은 `session-peer 0.1.0-preview.1 (typescript)`입니다. 설치 명령의
55
- `./...tgz`는 검증되지 않은 레지스트리 패키지가 아닌 로컬 산출물을 지정하므로 생략하지
56
- 마세요. 별도 승인된 npm 발행 이후에도 패키지명은 `session-peer`, 명령은
57
- `session-peer`로 유지하며 해당 릴리스의 버전·dist-tag 안내를 따릅니다.
54
+ 예상 출력은 `session-peer 0.1.0 (typescript)`입니다. 설치 명령의
55
+ `./...tgz`는 로컬 후보 산출물을 지정하므로 생략하지 마세요. 안정판의
56
+ 승인·검증이 끝나기 전까지 레지스트리 설치에는 정확한 버전을 지정하세요.
58
57
 
59
58
  ### 기존 설치본과 PATH
60
59
 
@@ -72,9 +71,9 @@ Python CLI를 덮어쓰지 않으려면 격리 prefix에 설치·제거할 수
72
71
  npm ci --ignore-scripts
73
72
  npm run build
74
73
  npm pack --ignore-scripts
75
- npm install --prefix "$env:TEMP\session-peer-ts-preview" --ignore-scripts .\session-peer-0.1.0-preview.1.tgz
76
- & "$env:TEMP\session-peer-ts-preview\node_modules\.bin\session-peer.cmd" --version
77
- # 이후 제거: npm uninstall --prefix "$env:TEMP\session-peer-ts-preview" session-peer
74
+ npm install --prefix "$env:TEMP\session-peer-ts-candidate" --ignore-scripts .\session-peer-0.1.0.tgz
75
+ & "$env:TEMP\session-peer-ts-candidate\node_modules\.bin\session-peer.cmd" --version
76
+ # 이후 제거: npm uninstall --prefix "$env:TEMP\session-peer-ts-candidate" session-peer
78
77
  ```
79
78
 
80
79
  ## 사용법
@@ -166,17 +165,23 @@ C 컴파일러와 lsof는 POSIX 계약 테스트에 필요합니다. CI는 참
166
165
 
167
166
  ## npm 발행 후 설치
168
167
 
169
- 공식 릴리스와 레지스트리 무결성·provenance 검증이 완료된 뒤에만 아래 정확한
170
- 프리뷰 버전을 설치하세요. 안정판 `latest` 채널이 아닙니다. 공개 전에는 위의
171
- 로컬 tarball 설치를 사용합니다.
168
+ 공개 프리뷰는 레지스트리 무결성·provenance·서명·새 환경 설치 검증을
169
+ 통과했습니다. 안정판 승격 전 버전 미지정 설치는 `latest`로 표시된 이전
170
+ `0.1.0-preview.0`을 선택하므로 아래 정확한 버전으로 설치하세요.
172
171
 
173
172
  ```sh
174
173
  npm install --global --ignore-scripts session-peer@0.1.0-preview.1
174
+ ```
175
+
176
+ 별도 승인된 `0.1.0` staging의 공개와 검증이 끝난 뒤에는 안정판을 정확한
177
+ 버전으로 설치하세요.
178
+
179
+ ```sh
180
+ npm install --global --ignore-scripts session-peer@0.1.0
175
181
  session-peer --version
176
182
  ```
177
183
 
178
- 수동 발행 워크플로우는 최초 1회만 단기 bootstrap 토큰을 사용합니다. 이후에는
179
- Trusted Publisher OIDC로 staging하고 유지관리자가 2FA로 승인합니다.
184
+ 수동 발행 워크플로우는 Trusted Publisher OIDC로 staging하고 유지관리자가 2FA로 승인합니다.
180
185
  staging 성공은 공개 완료가 아닙니다. [RELEASING.md](RELEASING.md)를 참고하세요.
181
186
 
182
187
  ## 관련 프로젝트
package/README.md CHANGED
@@ -2,12 +2,12 @@
2
2
 
3
3
  [English](README.md) | [한국어](README.ko.md) | [日本語](README.ja.md) | [简体中文](README.zh-CN.md)
4
4
 
5
- <!-- docs-contract: preview-candidate; package=session-peer; bin=session-peer; node=22.13+/24; python-reference=1.0.2 -->
5
+ <!-- docs-contract: stable-release-source; package=session-peer; bin=session-peer; node=22.13+/24; python-reference=1.0.2 -->
6
6
 
7
7
  Send messages to running **Claude Code and Codex sessions**, locally or on
8
8
  another machine over SSH. This TypeScript client runs on Node.js without Python.
9
9
 
10
- **Preview release candidate; publication requires separate approval.** Package name:
10
+ **0.1.0 stable release source; publication requires separate approval.** Package name:
11
11
  `session-peer`. CLI command: **`session-peer`**. This project does not provide
12
12
  a Relay server or hosted service.
13
13
 
@@ -36,9 +36,9 @@ existing key/host trust and the **same client version** on the destination.
36
36
 
37
37
  ## Install
38
38
 
39
- Do **not** run registry `npm install -g session-peer` or `npx session-peer`
40
- until an official npm release verifies ownership and provenance. Today, build
41
- a reviewed source checkout and optionally install its local tarball:
39
+ The verified `0.1.0-preview.1` is public. To evaluate the reviewed `0.1.0`
40
+ source before stable publication, build it and optionally install its local
41
+ tarball:
42
42
 
43
43
  ```sh
44
44
  git clone https://github.com/abruption/session-peer-ts.git
@@ -48,14 +48,13 @@ npm run build
48
48
  node dist/cli.js --version
49
49
  npm pack --ignore-scripts
50
50
  # Optional global install: first check which session-peer your PATH selects.
51
- npm install --global --ignore-scripts ./session-peer-0.1.0-preview.1.tgz
51
+ npm install --global --ignore-scripts ./session-peer-0.1.0.tgz
52
52
  session-peer --version
53
53
  ```
54
54
 
55
- Expected: `session-peer 0.1.0-preview.1 (typescript)`. Keep the `./...tgz` path;
56
- it selects the locally built artifact, not an unverified registry package.
57
- After a separately approved npm release, the package will remain `session-peer`
58
- while the command remains `session-peer`; follow that release's version/dist-tag.
55
+ Expected: `session-peer 0.1.0 (typescript)`. Keep the `./...tgz` path to
56
+ select the locally built candidate. Use an explicit version for registry
57
+ installation until the stable release has been approved and verified.
59
58
 
60
59
  ### Existing installations
61
60
 
@@ -73,9 +72,9 @@ On Windows PowerShell, inspect competing commands with
73
72
  npm ci --ignore-scripts
74
73
  npm run build
75
74
  npm pack --ignore-scripts
76
- npm install --prefix "$env:TEMP\session-peer-ts-preview" --ignore-scripts .\session-peer-0.1.0-preview.1.tgz
77
- & "$env:TEMP\session-peer-ts-preview\node_modules\.bin\session-peer.cmd" --version
78
- # Later: npm uninstall --prefix "$env:TEMP\session-peer-ts-preview" session-peer
75
+ npm install --prefix "$env:TEMP\session-peer-ts-candidate" --ignore-scripts .\session-peer-0.1.0.tgz
76
+ & "$env:TEMP\session-peer-ts-candidate\node_modules\.bin\session-peer.cmd" --version
77
+ # Later: npm uninstall --prefix "$env:TEMP\session-peer-ts-candidate" session-peer
79
78
  ```
80
79
 
81
80
  ## Use
@@ -116,7 +115,7 @@ authenticated OpenSSH control socket can be selected with
116
115
  `--ssh-control-path /absolute/local/socket`; this does not bypass host-key
117
116
  verification or grant a new login. For local Windows Codex commands, use a full
118
117
  `C:\Users\...\.codex` path for `--codex-home`. The Python CLI, if present,
119
- is not removed or replaced by this preview.
118
+ is not removed or replaced by this client.
120
119
 
121
120
  ### Replies
122
121
 
@@ -173,18 +172,25 @@ npm publish is enabled. Licensed under [MIT](LICENSE).
173
172
 
174
173
  ## npm release installation
175
174
 
176
- Only after the official release and registry integrity/provenance verification,
177
- install the exact preview below. It is not the stable `latest` channel. Before
178
- publication, keep using the local tarball instructions above.
175
+ The public preview passed registry integrity, provenance, signature and
176
+ fresh-install checks. Install it by exact version. Before stable promotion,
177
+ unversioned installs select the older `0.1.0-preview.0` marked `latest`:
179
178
 
180
179
  ```sh
181
180
  npm install --global --ignore-scripts session-peer@0.1.0-preview.1
181
+ ```
182
+
183
+ Only after the separately approved `0.1.0` stage is published and verified,
184
+ install the stable version by exact number:
185
+
186
+ ```sh
187
+ npm install --global --ignore-scripts session-peer@0.1.0
182
188
  session-peer --version
183
189
  ```
184
190
 
185
- The manual workflow initially uses a short-lived bootstrap token. Later versions
186
- use Trusted Publisher OIDC staging and require a maintainer's 2FA approval;
187
- a staged upload is not a public release. See [RELEASING.md](RELEASING.md).
191
+ The manual workflow uses Trusted Publisher OIDC staging and requires a
192
+ maintainer's 2FA approval; a staged upload is not a public release. See
193
+ [RELEASING.md](RELEASING.md).
188
194
 
189
195
  ## Related project
190
196
 
package/README.zh-CN.md CHANGED
@@ -2,11 +2,11 @@
2
2
 
3
3
  [English](README.md) | [한국어](README.ko.md) | [日本語](README.ja.md) | [简体中文](README.zh-CN.md)
4
4
 
5
- <!-- docs-contract: preview-candidate; package=session-peer; bin=session-peer; node=22.13+/24; python-reference=1.0.2 -->
5
+ <!-- docs-contract: stable-release-source; package=session-peer; bin=session-peer; node=22.13+/24; python-reference=1.0.2 -->
6
6
 
7
7
  向正在运行的 **Claude Code 和 Codex 会话**发送消息，支持本机和跨机器 SSH。这是运行于 Node.js 的 TypeScript 客户端，不需要 Python。
8
8
 
9
- **预览发布候选，正式上传需另行批准。**包名为 `session-peer`，CLI 命令为 **`session-peer`**。本项目不提供 Relay 服务器或托管服务。
9
+ **0.1.0 稳定版发布源码，正式发布需另行批准。**包名为 `session-peer`，CLI 命令为 **`session-peer`**。本项目不提供 Relay 服务器或托管服务。
10
10
 
11
11
  ## 功能与边界
12
12
 
@@ -23,7 +23,7 @@ macOS、Linux 或 Windows native；Node **22.x 中的 22.13 及以上，或 24.x
23
23
 
24
24
  ## 安装
25
25
 
26
- 在正式 npm 发布确认包归属和来源之前，**不要**运行注册表安装 `npm install -g session-peer` 或 `npx session-peer`。目前请构建经审查的源码，并按需安装本地 tarball：
26
+ 已验证的 `0.1.0-preview.1` 已公开。稳定版发布前评估经审查的 `0.1.0` 源码时，请构建源码，并按需安装本地 tarball：
27
27
 
28
28
  ```sh
29
29
  git clone https://github.com/abruption/session-peer-ts.git
@@ -33,17 +33,17 @@ npm run build
33
33
  node dist/cli.js --version
34
34
  npm pack --ignore-scripts
35
35
  # 可选：全局安装前先检查 PATH 选择的现有命令
36
- npm install --global --ignore-scripts ./session-peer-0.1.0-preview.1.tgz
36
+ npm install --global --ignore-scripts ./session-peer-0.1.0.tgz
37
37
  session-peer --version
38
38
  ```
39
39
 
40
- 预期输出：`session-peer 0.1.0-preview.1 (typescript)`。保留 `./...tgz` 路径，确保安装的是本地构建产物，而非未验证的注册表包。将来另行批准 npm 发布后，包名和命令名仍如上所示，请按该次发布的版本 / dist-tag 安装。
40
+ 预期输出：`session-peer 0.1.0 (typescript)`。保留 `./...tgz` 路径以选择本地候选产物。在稳定版获批并完成验证之前，从注册表安装时请指定准确版本。
41
41
 
42
42
  ### 与已有安装共存
43
43
 
44
44
  安装前后用 `type -a session-peer` 和 `command -v session-peer` 检查实际执行项。其他实现也可能提供同名命令；请选择 PATH 上的一种，或显式运行 `node /absolute/path/dist/cli.js`。不要用 `--force` 覆盖其他管理器的文件。本包不会自动安装、删除或调整 Python 包、技能或服务。卸载使用 `npm uninstall --global session-peer`，随后再次检查 PATH。
45
45
 
46
- 在 Windows PowerShell 中用 `Get-Command session-peer -All` 检查已有命令。为了不替换 Python CLI，可先执行 `npm ci --ignore-scripts`、`npm run build`、`npm pack --ignore-scripts`，再用 `npm install --prefix "$env:TEMP\session-peer-ts-preview" --ignore-scripts .\session-peer-0.1.0-preview.1.tgz` 安装到隔离目录。以 `& "$env:TEMP\session-peer-ts-preview\node_modules\.bin\session-peer.cmd" --version` 验证，并可用 `npm uninstall --prefix "$env:TEMP\session-peer-ts-preview" session-peer` 卸载。
46
+ 在 Windows PowerShell 中用 `Get-Command session-peer -All` 检查已有命令。为了不替换 Python CLI，可先执行 `npm ci --ignore-scripts`、`npm run build`、`npm pack --ignore-scripts`，再用 `npm install --prefix "$env:TEMP\session-peer-ts-candidate" --ignore-scripts .\session-peer-0.1.0.tgz` 安装到隔离目录。以 `& "$env:TEMP\session-peer-ts-candidate\node_modules\.bin\session-peer.cmd" --version` 验证，并可用 `npm uninstall --prefix "$env:TEMP\session-peer-ts-candidate" session-peer` 卸载。
47
47
 
48
48
  ## 使用
49
49
 
@@ -99,14 +99,20 @@ Python 只用作开发时的兼容性基准（v1.0.2，`47c23713d0a2a3c11ebde618
99
99
 
100
100
  ## npm 发布后的安装
101
101
 
102
- 仅在官方发布以及注册表完整性、provenance 验证完成后，安装以下精确预览版本。它不是稳定版 `latest`。公开前继续使用上述本地 tarball 安装。
102
+ 已公开的预览版通过了注册表完整性、provenance、签名及全新安装验证。稳定版升级前，未指定版本的安装会选中标记为 `latest` 的旧版 `0.1.0-preview.0`，因此请指定以下准确版本：
103
103
 
104
104
  ```sh
105
105
  npm install --global --ignore-scripts session-peer@0.1.0-preview.1
106
+ ```
107
+
108
+ 待另行批准的 `0.1.0` staging 获公开并验证后，再按准确版本安装稳定版：
109
+
110
+ ```sh
111
+ npm install --global --ignore-scripts session-peer@0.1.0
106
112
  session-peer --version
107
113
  ```
108
114
 
109
- 手动工作流仅在首次发布时使用短期 bootstrap 令牌。以后通过 Trusted Publisher OIDC 上传至 staging，由维护者使用 2FA 批准。staging 成功不代表已经公开发布。参见 [RELEASING.md](RELEASING.md)。
115
+ 手动工作流通过 Trusted Publisher OIDC 上传至 staging，由维护者使用 2FA 批准。staging 成功不代表已经公开发布。参见 [RELEASING.md](RELEASING.md)。
110
116
 
111
117
  ## 相关项目
112
118
 
package/RELEASING.md CHANGED
@@ -1,184 +1,118 @@
1
- # Releasing session-peer previews
2
-
3
- The package is publication-ready (`private:false`), not automatically published.
4
- Merging, pushing, tagging or publishing a GitHub release does not run publish.yml.
5
- Only an explicitly approved manual dispatch can upload. Python session-peer and
6
- its Relay release train remain independent.
7
-
8
- ## Before the first dispatch
9
-
10
- 1. Merge the reviewed preparation PR and require main's exact-commit `cli` CI
11
- (`release gate`) to pass. Match versions in package.json, lockfile,
12
- src/protocol.ts and four READMEs. Only `X.Y.Z-preview.N` versions and the
13
- `preview` dist-tag are supported; stable publication needs another review.
14
- 2. In GitHub Settings → Environments, create **npm** with at least one required
15
- reviewer. Restrict deployments to protected main. A solo maintainer may also
16
- be the dispatcher: this is explicit approval, not two-person separation.
17
- Do not bypass protection. Preflight rejects missing environments or reviewer
18
- rules. This PR does not create or relax environment protection.
19
- 3. Confirm npm account 2FA, package-name ownership and creation permissions.
20
- A registry 404 does not reserve the name. Review VALIDATION.md and architecture
21
- coverage; historical real-TUI ACKs predate the command rename. Do not claim
22
- full native-agent architecture coverage from CI fixtures.
23
- 4. For the initial **0.1.0-preview.0 only**, repository secret **NPM_TOKEN** supplies
24
- bootstrap authentication. Use a short-expiry, least-privilege granular token
25
- permitting this new package. Noninteractive direct publication requires a token
26
- allowed to bypass npm's 2FA prompt. Secret existence does not establish its
27
- permissions. Do not weaken account policy automatically: stop if unsuitable
28
- and use an approved local interactive first publish instead.
29
- Never put credentials in files, logs, issues or chat. Builds/tests/packing
30
- never receive this secret.
31
- 5. Obtain final approval for the exact main commit, version and mode. A merged
32
- preparation PR is not publication approval. Optional GitHub draft release
33
- notes must target that same commit; the workflow creates no tag or release.
34
- Runtime changes require separate reviewed evidence.
35
-
36
- ## First package: bootstrap-token
37
-
38
- ### Initial failed attempt (2026-09-27)
39
-
40
- [Run 36308424358](https://github.com/abruption/session-peer-ts/actions/runs/36308424358)
41
- attempted the old npm name `session-peer-ts@0.1.0-preview.0`. Build and artifact
42
- checks passed, but the registry refused the PUT with HTTP 403 / E_STAGE_REQUIRED:
43
- the supplied token could only stage, and the package did not exist. A Sigstore
44
- provenance entry was created before that rejection; it is not proof of npm
45
- publication. Both npm names returned 404 during the subsequent read-only check.
46
-
47
- The intended npm name is now **session-peer**; the GitHub repository remains
48
- **abruption/session-peer-ts**. Renaming does not fix the authentication restriction.
49
- Do not rerun the old workflow or switch it to staging: a new package cannot be
50
- created by staging. Before an approved new attempt, the owner must resolve the
51
- initial direct-publication authorization or perform an approved interactive
52
- first publish with 2FA. Do not disable 2FA, automatically replace credentials or
53
- assume changing a token option bypasses current npm policy. The stored secret's
54
- value and settings were not inspected. This PR does not reattempt publication.
55
-
56
- ### Inputs after authentication is resolved
57
-
58
- Actions → **npm preview publication** → Run workflow → **main**:
59
-
60
- - mode: `bootstrap-token`
61
- - version: `0.1.0-preview.0`
62
- - confirmation: `session-peer@0.1.0-preview.0 bootstrap-token`
63
-
64
- Preflight requires current main SHA, successful exact-commit main CI and the
65
- protected npm environment. Bootstrap refuses **any existing registry package**
66
- under this name. The prepare job tests without publication credentials, packs
67
- twice, compares hashes, checks the allowlist and tests installation/uninstallation
68
- of the exact tarball. Its retained artifact includes tarball and manifest.json
69
- (commit, SHA-256 and SHA-512 integrity). Actions are pinned by commit; release
70
- builds use Node 24/npm 11.15.0 without dependency caches or lifecycle scripts.
71
-
72
- After environment approval, a fresh job downloads the artifact without rebuilding,
73
- rechecks main/CI/registry and validates its contents. Only one `npm publish`
74
- step receives NPM_TOKEN (`--tag preview --access public --provenance
75
- --ignore-scripts`). OIDC permission is also granted for provenance. Upload
76
- network retries are disabled. Do not rerun failed or uncertain publication.
77
-
78
- Verification compares registry integrity and preview tag, rejects accidental
79
- latest promotion, requires registry attestation metadata, runs `npm audit
80
- signatures`, and fresh-installs/uninstalls the published version. Only a passed
81
- verification completes bootstrap release; a successful upload alone does not.
82
- Bounded read-only propagation checks are not upload retries.
83
-
84
- ## Register npm Trusted Publisher after the first release
85
-
86
- npmjs.com → package **session-peer** → Settings → Trusted publishing:
87
-
88
- | Field | Value |
89
- | --- | --- |
90
- | Provider | GitHub Actions |
91
- | Organization or user | `abruption` |
92
- | Repository | `session-peer-ts` |
93
- | Workflow filename | `publish.yml` (no directory prefix) |
94
- | Environment name | `npm` |
95
- | Allowed actions | Stage-only: `npm stage publish`, not direct `npm publish` |
96
-
97
- The workflow must exist on main. npm does not validate the connection on save;
98
- validate it with the next authorized staged version. GitHub-hosted runners are
99
- required. Public GitHub + public npm OIDC publishing provides provenance.
100
-
101
- After verifying bootstrap and configuring trust, revoke its token in npm and
102
- remove GitHub NPM_TOKEN. Set npm publishing access to **Require two-factor
103
- authentication and disallow tokens**. These account changes need owner approval
104
- and are not performed by this workflow. trusted-stage never references NPM_TOKEN;
105
- an OIDC failure must not cause token fallback. Remove the bootstrap branch in a
106
- follow-up PR.
107
-
108
- ## Later previews: trusted-stage
109
-
110
- Prepare a new immutable preview version through a PR. Dispatch main with mode
111
- `trusted-stage`, its exact version and confirmation
112
- `session-peer@<version> trusted-stage`. The same gates apply. The package must
113
- already exist; published versions are refused. One `npm stage publish` runs
114
- with OIDC and the preview tag.
115
-
116
- ### 0.1.0-preview.1 candidate
117
-
118
- This candidate includes the merged TypeScript declaration, SSH preflight,
119
- publication-verification and native Windows changes (#7–#10). Its publication
120
- mode is `trusted-stage`; `bootstrap-token` is reserved for preview.0 and must
121
- not be reused. The existing `latest` tag is retained. For this
122
- exact candidate, preflight requires both `latest` and `preview` to point to
123
- preview.0, confirms the registry has no `0.1.0-preview.1` version, and requires
124
- the exact-main CI gate. No npm tag action is part of this release. After npm
125
- stage approval, verification requires `preview` to point to preview.1 while
126
- `latest` still points to preview.0. An unversioned install continues to select
127
- preview.0; use the explicit `session-peer@0.1.0-preview.1` version for testing.
128
- Other prerelease `latest` states remain blocked, including future candidates.
129
- Do not infer publication from local packaging, a green PR, or an approved stage.
130
-
131
- **A successful staged run is pending approval, not a public release.** Record its
132
- stage ID from npm output. Review its tarball against the retained manifest and
133
- approve with 2FA in npmjs.com or interactive `npm stage approve`. OIDC cannot
134
- approve, list or view stages. Public registry metadata cannot reveal pending
135
- stages, so collisions fail at the registry and need manual inspection, not retries.
136
-
137
- After approval, check out the exact source commit and download that run artifact
138
- into `release-dist/`. With Node 24 and npm 11.15.0:
1
+ # Releasing session-peer
2
+
3
+ Publication is manual. Merging, pushing, tagging or creating a GitHub release
4
+ never dispatches `publish.yml`. Python session-peer and its Relay release train
5
+ remain independent. The npm Trusted Publisher for `abruption/session-peer-ts`,
6
+ `publish.yml`, environment `npm` allows `npm stage publish` only. The workflow
7
+ uses OIDC and no npm token. The protected GitHub environment requires a reviewer
8
+ and permits deployments from `main` only.
9
+
10
+ ## Verified preview and stable baseline — 2026-09-27
11
+
12
+ `session-peer@0.1.0-preview.1` was staged from main commit
13
+ `f65d3ee99cc26ff4a267aef84e31a308d034ac80` in
14
+ [run 36313884100](https://github.com/abruption/session-peer-ts/actions/runs/36313884100)
15
+ and published after a separate 2FA approval. The staged tarball matched the
16
+ retained run artifact byte for byte. Public verification passed registry
17
+ integrity, provenance metadata, `npm audit signatures`, fresh installation and
18
+ uninstallation. The artifact SHA-256 was
19
+ `d154beac93893b60b0695e5a6296e185beb8dbd05188ffe04befb74d29966110`;
20
+ registry integrity is
21
+ `sha512-h4SMvrQ/LWA9osd4EHIs9rSTqv1u+S3MXQAmn+yG/gZ9+7NwYMutq+Oa5K/0ggIq61Wfwdh11Cv+5YdEffiNMA==`.
22
+ The `preview` tag points to preview.1. The existing `latest` tag still points
23
+ to preview.0. No stable version has been published by this preparation PR.
24
+
25
+ ## Prepare 0.1.0 stable
26
+
27
+ 1. Merge the reviewed 0.1.0 preparation PR. Require successful `cli` CI on the
28
+ exact merged `main` commit, including the release gate and Windows Node 22/24.
29
+ Match `0.1.0` in package.json, lockfile, src/protocol.ts and all four READMEs.
30
+ Review [VALIDATION.md](VALIDATION.md): fixture CI and the historical real-TUI
31
+ ACKs have different scope. The stable candidate changes the version handshake
32
+ and release controls, not native delivery behavior.
33
+ 2. Confirm the `npm` environment still has a required reviewer and permits only
34
+ protected main. Confirm npm account 2FA, package ownership and the Trusted
35
+ Publisher's stage-only mapping above. Do not bypass environment protection.
36
+ 3. Read the public registry. `0.1.0` must be absent; `preview` must still point
37
+ to preview.1 and `latest` to preview.0. The published preview.1 integrity and
38
+ provenance must match the verified baseline above. Inspect pending stages with
39
+ `npm stage list session-peer` through an authenticated owner session;
40
+ public registry metadata cannot reveal them.
41
+ 4. Obtain final approval for the **exact main SHA**, `0.1.0` version and
42
+ `stable-stage` mode. A merged PR is not publication approval. The approval
43
+ must also cover promotion of npm `latest` to `0.1.0` when the stage is
44
+ approved. GitHub tag, release and fleet installation need separate decisions.
45
+
46
+ Dispatch Actions → **npm staged publication** → Run workflow → **main**:
47
+
48
+ - mode: `stable-stage`
49
+ - version: `0.1.0`
50
+ - confirmation: `session-peer@0.1.0 stable-stage`
51
+
52
+ The prepare job requires exact-main CI and the protected npm environment. It
53
+ checks the registry baseline, tests on Node 24/npm 11.15.0 without publish
54
+ credentials, packs twice, compares hashes, checks the allowlist and installs and
55
+ uninstalls the exact tarball in isolation. The retained `npm-release-<SHA>`
56
+ artifact contains the tarball and manifest.json with commit, SHA-256 and
57
+ SHA-512 integrity. Actions are pinned by commit; no dependency cache or package
58
+ lifecycle scripts are used.
59
+
60
+ After environment review, the publish job downloads that artifact without
61
+ rebuilding and repeats the main/CI/registry and artifact checks. Only one
62
+ `npm stage publish ... --tag latest --provenance --ignore-scripts` step runs with
63
+ OIDC. Network upload retries are disabled. **A successful staged workflow is
64
+ pending npm approval, not a public release.** Record the stage ID. Download its
65
+ tarball, compare it byte for byte with the retained run artifact, and obtain a
66
+ separate final approval before the owner approves that exact stage with 2FA on
67
+ npmjs.com or through interactive `npm stage approve <stage-id>`. OIDC cannot
68
+ approve, list or view stages.
69
+
70
+ After 2FA approval, check out the exact source commit and download the run
71
+ artifact into `release-dist/`. With Node 24 and npm 11.15.0:
139
72
 
140
73
  ```sh
141
74
  node scripts/release.mjs artifact
142
75
  node scripts/release.mjs verify
143
76
  ```
144
77
 
145
- Neither command publishes. verify uses public reads, an isolated no-lifecycle
146
- install and signature checks; it needs no publish token. Do not announce release
147
- completion until it passes. Stable promotion and fleet installation remain
148
- separate decisions.
78
+ Neither command publishes. Verification requires the public 0.1.0 integrity,
79
+ registry provenance metadata, `latest: 0.1.0`, unchanged
80
+ `preview: 0.1.0-preview.1`, npm signature audit, and fresh install/uninstall. Announce
81
+ stable availability only after this passes. Review a Git tag, GitHub release or
82
+ fleet rollout separately.
83
+
84
+ ## Later previews
85
+
86
+ The manual workflow still accepts `trusted-stage` for a new immutable preview
87
+ version with package `publishConfig.tag: preview`; it stages with OIDC and never
88
+ directly publishes. Preview preflight refuses an already published version and
89
+ requires `latest` to be stable or absent. The historical preview.1 exception
90
+ required its exact legacy `latest: 0.1.0-preview.0` and cannot authorize a
91
+ future version. Every stage needs artifact review and a separate 2FA approval.
149
92
 
150
93
  ## Failure handling
151
94
 
152
- Missing/invalid token, 2FA challenge, missing environment, bad OIDC mapping,
153
- non-404 registry errors, stale main, conflicting versions, upload timeout and
154
- hash mismatch are stop conditions. Never automatically change auth mode, retry
155
- upload, unpublish, move a tag, reuse a version or promote latest to obtain green
156
- checks. Inspect registry/staged state and retained evidence first. Read-only
157
- verification of the exact artifact may be repeated; publication may not.
158
- A broken/partial public release requires a reviewed new version and approval.
159
-
160
- ### First publication propagation and tag state
161
-
162
- The first public `0.1.0-preview.0` upload returned success, while its workflow
163
- verification initially saw registry 404 responses. The exact tarball, provenance
164
- and isolated install were later verified, but the run remains failed. Verification
165
- now waits for up to 30 read attempts (two seconds between reads) before reporting
166
- that a published version is still invisible. Never re-upload that version.
167
-
168
- The registry also assigned both `preview` and `latest` to the initial preview
169
- despite the explicit `--tag preview`. The preview.1 gate preserves this exact
170
- legacy `latest` value and refuses any change to it; the exception does not apply
171
- to later versions. Review the current tags and agree on a separate operator
172
- action in npm before changing a tag; the workflow never does so. A verification
173
- failure from the tag check does not mean the upload failed. Record upload,
174
- registry propagation, tag state and install verification separately.
95
+ Missing environment protection, bad OIDC mapping, stale main, failed CI,
96
+ conflicting version or tag state, an existing stage, upload timeout, hash
97
+ mismatch and non-404 registry errors are stop conditions. Do not automatically
98
+ retry an uncertain upload, change authentication mode, move a tag, unpublish,
99
+ reuse a version or approve a stage. Inspect the run, stage and public registry
100
+ first. Registry propagation may lag a successful approval: `verify` performs
101
+ bounded read-only waits, never a second upload. A broken public release needs a
102
+ reviewed new version and its own approval.
103
+
104
+ The first preview.0 used a bootstrap token, and the registry assigned both
105
+ `preview` and `latest` to it despite `--tag preview`. That bootstrap path is
106
+ closed in this workflow. The repository `NPM_TOKEN` secret and any remaining
107
+ bootstrap credential should be removed through a separate owner-approved account
108
+ operation; this PR neither reads nor changes those credentials.
175
109
 
176
110
  ## Sources
177
111
 
178
112
  - [npm trusted publishing](https://docs.npmjs.com/trusted-publishers/)
179
113
  - [npm staged publishing](https://docs.npmjs.com/staged-publishing)
180
- - [npm stage CLI and token/2FA behavior](https://docs.npmjs.com/cli/v11/commands/npm-stage)
114
+ - [npm stage CLI](https://docs.npmjs.com/cli/v11/commands/npm-stage)
181
115
 
182
- Requirements checked 2026-09-27: OIDC needs npm ≥11.5.1, staging ≥11.15.0, both
183
- with Node ≥22.14.0. Application support remains Node 22.13+ within 22.x and 24.x;
184
- release-tool requirements are separate.
116
+ OIDC needs npm >=11.5.1 and staging needs npm >=11.15.0 with Node >=22.14.0.
117
+ Application support remains Node 22.13+ within 22.x and 24.x; release-tool
118
+ requirements are separate.
package/VALIDATION.md CHANGED
@@ -1,9 +1,37 @@
1
1
  # Validation record — 2026-09-27 KST
2
2
 
3
- This is preview evidence, not an npm release or a claim of complete Python parity.
3
+ This record distinguishes historical live-agent evidence, the verified public
4
+ preview and the unpublished 0.1.0 stable candidate. It does not claim complete
5
+ Python parity.
4
6
  Python reference: v1.0.2, commit `47c23713d0a2a3c11ebde6186afd8c43489b8b65`.
5
7
 
6
- ## 0.1.0-preview.1 candidate
8
+ ## Public 0.1.0-preview.1 — 2026-09-27 KST
9
+
10
+ The preview.1 candidate and exact merged main passed macOS/Linux Node 22/24,
11
+ native Windows Node 22/24 and the release gate. A separate gate change preserved
12
+ the existing `latest: 0.1.0-preview.0` while permitting preview.1 staging.
13
+ [Run 36313884100](https://github.com/abruption/session-peer-ts/actions/runs/36313884100)
14
+ staged the exact main commit `f65d3ee99cc26ff4a267aef84e31a308d034ac80`
15
+ through the stage-only OIDC Trusted Publisher. After separate environment and
16
+ npm 2FA approvals, the public registry showed `preview: 0.1.0-preview.1` and
17
+ unchanged `latest: 0.1.0-preview.0`.
18
+
19
+ The npm stage tarball matched the retained run artifact byte for byte. Its
20
+ SHA-256 was `d154beac93893b60b0695e5a6296e185beb8dbd05188ffe04befb74d29966110`.
21
+ The public SHA-512 integrity and provenance metadata matched the manifest;
22
+ `npm audit signatures`, fresh version-specific install, CLI version and empty
23
+ Claude discovery checks, and uninstall passed. This verifies package delivery,
24
+ not a new live Claude/Codex message ACK from the published build.
25
+
26
+ ## 0.1.0 stable candidate
27
+
28
+ This preparation updates the version handshake, package metadata, four README
29
+ languages, release gates and tests. Native delivery logic is unchanged. The
30
+ candidate must pass its PR and exact merged-main CI before a separate decision
31
+ to stage `0.1.0`; staging, npm 2FA approval, public verification and any GitHub
32
+ tag or fleet installation remain separate gates.
33
+
34
+ ## Historical 0.1.0-preview.1 candidate checks
7
35
 
8
36
  After #7–#10 were merged, the versioned candidate passed the local macOS
9
37
  arm64 Node 22 contract suite (23 passed, two Windows-only tests skipped),
@@ -104,9 +132,9 @@ package/release fixtures, not claimed as new live ACK evidence.
104
132
 
105
133
  ## Not covered / not released
106
134
 
107
- Windows arm64, IPv6 literals, Relay/MCP/wake, full Python
108
- CLI parity, automatic reverse-route detection, npm registry publishing and
109
- provenance are outside this historical evidence. Publication preparation now
110
- removes the private flag, but actual publishing still needs separate approval
111
- and the gates in RELEASING.md. Native dependency prebuild availability must be tested
112
- on each architecture claimed by a future release.
135
+ Windows arm64, IPv6 literals, Relay/MCP/wake, full Python CLI parity and
136
+ automatic reverse-route detection remain outside this evidence. Registry
137
+ publishing and provenance are verified for preview.1 above, but not by the
138
+ historical live-agent ACKs. Stable 0.1.0 publishing still needs the separate
139
+ approvals and gates in RELEASING.md. Native dependency prebuild availability
140
+ must be tested on each architecture claimed by a future release.
package/dist/protocol.d.ts CHANGED
@@ -1,5 +1,5 @@
1
- export declare const VERSION = "0.1.0-preview.1";
2
- export declare const VERSION_LINE = "session-peer 0.1.0-preview.1 (typescript)";
1
+ export declare const VERSION = "0.1.0";
2
+ export declare const VERSION_LINE = "session-peer 0.1.0 (typescript)";
3
3
  export declare function host(value: string): string;
4
4
  export declare function reply(value: string): {
5
5
  to: string;
package/dist/protocol.js CHANGED
@@ -1,6 +1,6 @@
1
1
  import { Refusal } from './discovery.js';
2
2
  import { uuid } from './writer.js';
3
- export const VERSION = '0.1.0-preview.1';
3
+ export const VERSION = '0.1.0';
4
4
  export const VERSION_LINE = `session-peer ${VERSION} (typescript)`;
5
5
  export function host(value) {
6
6
  if (value.length > 255 || !/^(?:[A-Za-z0-9_][A-Za-z0-9_.-]*@)?[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(value))
package/package.json CHANGED
@@ -1,15 +1,15 @@
1
1
  {
2
2
  "name": "session-peer",
3
- "version": "0.1.0-preview.1",
3
+ "version": "0.1.0",
4
4
  "private": false,
5
5
  "publishConfig": {
6
6
  "registry": "https://registry.npmjs.org/",
7
7
  "access": "public",
8
- "tag": "preview"
8
+ "tag": "latest"
9
9
  },
10
10
  "repository": { "type": "git", "url": "git+https://github.com/abruption/session-peer-ts.git" },
11
11
  "os": ["darwin", "linux", "win32"],
12
- "description": "Python-free local and SSH client for Claude Code and Codex sessions (preview)",
12
+ "description": "Python-free local and SSH client for Claude Code and Codex sessions",
13
13
  "type": "module",
14
14
  "types": "./dist/index.d.ts",
15
15
  "exports": {