toolfactory 0.1.1 → 0.2.0

package/dist/surfaces/workflows.js

@@ -19,6 +19,8 @@
  */
 import { stringify as yamlStringify } from "yaml";
 import { LIVE_TEST_COMMAND } from "../bindings/python.js";
+import { nativePublishJobs } from "../distribution/native.js";
+import { systemPackageJobs, systemPublishJobs } from "../distribution/system.js";
 import { githubOwner } from "../identity/name.js";
 import { isInstructionOnly, } from "../model.js";
 import { bootstrapSteps, gateSteps, gateVariable, MCP_PUBLISHER_FETCH, npmTarball, openclawTarball, outputsStep, PACKAGE_MANAGER_COMMANDS, packageSteps, RELEASE_DIR, RELEASE_SECRET_NAMES, registries, tagVersionAssert, toolfactoryCli, unpublishStep, WEB_BUILD, } from "../project/gate.js";
@@ -28,6 +30,7 @@ import { ociImage, registryName } from "./mcp-registry.js";
 import { HOST_DIR as OPENCLAW_HOST_DIR } from "./openclaw-native.js";
 import { compact, configProperties, envName, has, isSensitive, liveCredentials, npmName, requiredConfig, } from "./shared.js";
 import { skillPath } from "./skill.js";
+import { OVSX_VERSION, VSCE_VERSION, vsixName } from "./vscode-extension.js";
 const YAML_HEADER = "# Generated by toolfactory. Do not edit; run `toolfactory build` to regenerate.\n\n";
 /** The one artifact the `package` job uploads and every later job reads. */
 const RELEASE_ARTIFACT = "release-assets";
@@ -182,6 +185,7 @@ function ciDocument(project) {
     const node = typescript ? "${{ matrix.node-version }}" : "24";
     const job = compact({
         "runs-on": "ubuntu-latest",
+        env: { TOOLFACTORY_SYSTEM_NATIVE_JOBS: "true" },
         strategy: typescript ? { matrix: { "node-version": ["22", "24"] } } : undefined,
         steps: [
             ...toolchainSteps(project, node),
@@ -199,7 +203,7 @@ function ciDocument(project) {
             workflow_dispatch: live ? {} : undefined,
         }),
         permissions: { contents: "read" },
-        jobs: compact({ test: job, live }),
+        jobs: compact({ test: job, live, ...systemPackageJobs(project, "${{ github.sha }}") }),
     };
 }
 // ---------------------------------------------------------------------------------------------
@@ -362,11 +366,15 @@ function releaseDocument(project) {
     };
     const cli = toolfactoryCli(project);
     const assert = tagVersionAssert(project);
+    const systemJobs = systemPackageJobs(project, RELEASE_SHA);
+    for (const job of Object.values(systemJobs))
+        job.needs = "gate";
     const jobs = {
+        ...systemJobs,
         gate: compact({
             "runs-on": "ubuntu-latest",
             permissions: compact({ contents: "read", pages: has(project, "web") ? "read" : undefined }),
-            env: { RELEASE_TAG: TAG_NAME },
+            env: { RELEASE_TAG: TAG_NAME, TOOLFACTORY_SYSTEM_NATIVE_JOBS: "true" },
             outputs: { sha: "${{ steps.tag.outputs.sha }}", ...presenceOutputs(rows) },
             steps: [
                 // The whole history: the tag may exist (a re-run) or not yet (a dispatch cuts it), and
@@ -385,7 +393,7 @@ function releaseDocument(project) {
             ],
         }),
         package: compact({
-            needs: "gate",
+            needs: needsOf(["gate", ...Object.keys(systemJobs)]),
             "runs-on": "ubuntu-latest",
             permissions: { contents: "read" },
             // The Firefox self-hosted xpi packageSteps emits (gate.ts) is opt-in on this pair: present,
@@ -398,7 +406,11 @@ function releaseDocument(project) {
                 : undefined,
             steps: [
                 ...toolchainSteps(project, "24", RELEASE_SHA),
-                ...packageSteps(project).map((step) => actionStep(step, false)),
+                ...packageSteps(project, { system: false }).map((step) => actionStep(step, false)),
+                ...Object.keys(systemJobs).map((name) => ({
+                    uses: "actions/download-artifact@v8",
+                    with: { name, path: `${RELEASE_DIR}/system/${name.replace(/^system-/, "")}` },
+                })),
                 {
                     uses: "actions/upload-artifact@v7",
                     with: { name: RELEASE_ARTIFACT, path: `${RELEASE_DIR}/` },
@@ -406,9 +418,14 @@ function releaseDocument(project) {
             ],
         }),
     };
-    const priorLegs = [];
+    Object.assign(jobs, systemPublishJobs(project, RELEASE_ARTIFACT, RELEASE_SHA));
+    const nativeJobs = nativePublishJobs(project, RELEASE_ARTIFACT, RELEASE_SHA);
+    Object.assign(jobs, nativeJobs);
+    const priorLegs = Object.keys(nativeJobs);
     if (npmSelected) {
-        const tarball = `${RELEASE_ARTIFACT}/${npmTarball(project)}`;
+        // npm treats a slash-containing bare operand as a Git spec; make the downloaded archive a
+        // filesystem path explicitly.
+        const tarball = `./${RELEASE_ARTIFACT}/${npmTarball(project)}`;
         jobs["publish-npm"] = compact({
             needs: ["gate", "package"],
             if: gated("npm"),
@@ -442,18 +459,20 @@ function releaseDocument(project) {
     }
     if (pypiSelected) {
         jobs["publish-pypi"] = compact({
-            needs: "gate",
+            needs: ["gate", "package"],
             if: gated("pypi"),
             "runs-on": "ubuntu-latest",
             environment: "pypi",
             permissions: { "id-token": "write" },
             steps: [
-                checkoutStep(RELEASE_SHA),
-                { uses: "astral-sh/setup-uv@v6" },
-                { run: "uv build" },
+                {
+                    uses: "actions/download-artifact@v8",
+                    with: { name: RELEASE_ARTIFACT, path: RELEASE_ARTIFACT },
+                },
                 {
                     name: "Publish package distributions to PyPI",
                     uses: "pypa/gh-action-pypi-publish@release/v1",
+                    with: { "packages-dir": `${RELEASE_ARTIFACT}/pypi/`, "skip-existing": true },
                 },
             ],
         });
@@ -581,6 +600,33 @@ function releaseDocument(project) {
             comments.push("", "publish-browser-ext-safari (opt-in, tool.json browserExtension.safari) is the macOS", "host-native leg: xcrun safari-web-extension-converter, then an Xcode archive/export", "signed with an App Store Connect API key. Runs on macos-latest, needs only `gate`, and", "does not gate the release — it submits to App Store Connect, not dist/release/.");
         }
     }
+    for (const id of ["vscode-marketplace", "open-vsx"]) {
+        const row = rows.find((entry) => entry.id === id);
+        if (!row)
+            continue;
+        const file = `./${RELEASE_ARTIFACT}/${vsixName(project)}`;
+        const publish = id === "vscode-marketplace"
+            ? `npx --yes @vscode/vsce@${VSCE_VERSION} publish --packagePath ${file} --skip-duplicate`
+            : `npx --yes ovsx@${OVSX_VERSION} publish ${file} --skip-duplicate`;
+        const job = `publish-${id}`;
+        const runtimeJob = project.tool.binding === "python" ? "publish-pypi" : "publish-npm";
+        jobs[job] = {
+            needs: ["gate", "package", runtimeJob],
+            if: `!cancelled() && !contains(needs.*.result, 'failure') && ${gated(id)}`,
+            "runs-on": "ubuntu-latest",
+            permissions: { contents: "read" },
+            env: Object.fromEntries(row.secrets.map((key) => [key, `\${{ secrets.${key} }}`])),
+            steps: [
+                { uses: "actions/setup-node@v7", with: { "node-version": "24" } },
+                {
+                    uses: "actions/download-artifact@v8",
+                    with: { name: RELEASE_ARTIFACT, path: RELEASE_ARTIFACT },
+                },
+                { name: `Publish ${id}`, run: publish },
+            ],
+        };
+        priorLegs.push(job);
+    }
     jobs.release = {
         // The tag's own release, after every leg: the assets are the same ones the registries got.
         // Skipped legs must not skip it, only failed ones; hence the explicit condition.
@@ -616,7 +662,7 @@ function releaseDocument(project) {
                     // A tag the dispatch is cutting does not exist yet: the Release creates it here.
                     target_commitish: RELEASE_SHA,
                     generate_release_notes: true,
-                    files: `${RELEASE_ARTIFACT}/*`,
+                    files: `${RELEASE_ARTIFACT}/**/*`,
                     fail_on_unmatched_files: true,
                 },
             },

package/dist/surfaces/workflows.test.js

@@ -120,6 +120,73 @@ describe("workflows", () => {
         });
         expect(steps.some((s) => s.run === "uv run --with pytest pytest -q")).toBe(true);
     });
+    it("installs a native Python core into Hermes only in validation jobs", () => {
+        const python = project(["cli", "mcp", "hermes-native"], {
+            tool: {
+                ...project(["cli"]).tool,
+                binding: "python",
+                surfaces: ["cli", "mcp", "hermes-native"],
+            },
+        });
+        const files = emitted(python);
+        const ci = yamlParse(files[".github/workflows/ci.yml"]);
+        const release = yamlParse(files[".github/workflows/release.yml"]);
+        const command = 'uv pip install --python "$HOME/.hermes/hermes-agent/venv/bin/python" --editable .';
+        const ciRuns = ci.jobs.test.steps.map((step) => step.run);
+        const gateRuns = release.jobs.gate.steps.map((step) => step.run);
+        const packageRuns = release.jobs.package.steps.map((step) => step.run);
+        const ciValidate = ciRuns.findIndex((run) => run?.endsWith(" validate"));
+        const gateValidate = gateRuns.findIndex((run) => run?.endsWith(" validate"));
+        expect(ciRuns.indexOf(command)).toBeGreaterThan(ciRuns.indexOf("uv sync"));
+        expect(ciRuns.indexOf(command)).toBeLessThan(ciValidate);
+        expect(gateRuns.indexOf(command)).toBeGreaterThan(gateRuns.indexOf("uv sync"));
+        expect(gateRuns.indexOf(command)).toBeLessThan(gateValidate);
+        expect(packageRuns).not.toContain(command);
+        const withoutHermes = project(["cli", "mcp"], {
+            tool: { ...project(["cli"]).tool, binding: "python", surfaces: ["cli", "mcp"] },
+        });
+        const typescriptHermes = project(["cli", "mcp", "hermes-native"]);
+        expect(emitted(withoutHermes)[".github/workflows/ci.yml"]).not.toContain(command);
+        expect(emitted(typescriptHermes)[".github/workflows/ci.yml"]).not.toContain(command);
+    });
+    it("publishes the package job's prebuilt Python distributions", () => {
+        const python = project(["pypi", "web"], {
+            tool: { ...project([]).tool, binding: "python", surfaces: ["pypi", "web"] },
+        });
+        const release = yamlParse(emitted(python)[".github/workflows/release.yml"] ?? "");
+        const publish = release.jobs["publish-pypi"];
+        expect(publish.needs).toEqual(["gate", "package"]);
+        expect(publish.steps).toEqual([
+            {
+                uses: "actions/download-artifact@v8",
+                with: { name: "release-assets", path: "release-assets" },
+            },
+            {
+                name: "Publish package distributions to PyPI",
+                uses: "pypa/gh-action-pypi-publish@release/v1",
+                with: { "packages-dir": "release-assets/pypi/", "skip-existing": true },
+            },
+        ]);
+        expect(release.jobs.release.steps.at(-1)?.with.files).toBe("release-assets/**/*");
+        expect(packageSteps(python).find((step) => step.name === "web build")).toBeDefined();
+        expect(packageSteps(python).find((step) => step.name === "python distributions")?.run).toBe("uv build --out-dir dist/release/pypi");
+        const mcpbPython = project(["pypi", "mcp", "mcpb", "web"], {
+            tool: {
+                ...project([]).tool,
+                binding: "python",
+                surfaces: ["pypi", "mcp", "mcpb", "web"],
+            },
+        });
+        const mcpb = packageSteps(mcpbPython).find((step) => step.name === "MCPB bundle")?.run;
+        expect(packageSteps(mcpbPython).map((step) => step.name)).toEqual(expect.arrayContaining(["python distributions", "MCPB bundle"]));
+        expect(packageSteps(mcpbPython)
+            .map((step) => step.name)
+            .indexOf("python distributions")).toBeLessThan(packageSteps(mcpbPython)
+            .map((step) => step.name)
+            .indexOf("MCPB bundle"));
+        expect(mcpb).toContain("tar -xzf dist/release/pypi/*.tar.gz -C dist/mcpb --strip-components=1");
+        expect(mcpb).not.toContain("cp -R src dist/mcpb/src");
+    });
     it("release.yml runs the legs in the forced order npm -> oci -> mcp-registry -> clawhub, each gated on what the gate decided", () => {
         const files = emitted(project(["npm", "mcp-registry", "clawhub", "openclaw-native", "skill", "claude", "web", "mcp"], {
             identity: {
@@ -265,8 +332,8 @@ describe("workflows", () => {
         // configured publisher selects OIDC; otherwise the stored token is a fallback. A re-dispatch
         // after adding either credential must not attempt to republish an immutable version.
         expect(release.jobs["publish-npm"].steps.some((s) => s.run?.includes("npm view hello@0.1.0 version") &&
-            s.run?.includes('elif [ "$NPM_TRUSTED_PUBLISHER" = true ]; then npm publish release-assets/hello-0.1.0.tgz --access public') &&
-            s.run?.includes('NODE_AUTH_TOKEN="$NPM_TOKEN" npm publish release-assets/hello-0.1.0.tgz --access public'))).toBe(true);
+            s.run?.includes('elif [ "$NPM_TRUSTED_PUBLISHER" = true ]; then npm publish ./release-assets/hello-0.1.0.tgz --access public') &&
+            s.run?.includes('NODE_AUTH_TOKEN="$NPM_TOKEN" npm publish ./release-assets/hello-0.1.0.tgz --access public'))).toBe(true);
         // The oci leg pushes the very image server.json's oci entry names.
         const meta = release.jobs["publish-oci"].steps.find((s) => s.id === "meta");
         expect(meta?.with?.images).toBe("ghcr.io/acme/hello");
@@ -465,6 +532,7 @@ describe("gate", () => {
             "toolfactory validate",
             "author checks",
             "author tests",
+            "author integration tests",
             "openclaw end-to-end (scripted model, no LLM key)",
         ]);
         // `npm ci` and a global CLI install are the runner's job, not a checkout's: `toolfactory gate`
@@ -491,7 +559,7 @@ describe("gate", () => {
         ]);
         const runs = packageSteps(target).map((step) => step.run);
         expect(runs).toContain("npm pack --pack-destination dist/release");
-        expect(runs).toContain("uv build --out-dir dist/release");
+        expect(runs).toContain("uv build --out-dir dist/release/pypi");
         expect(runs.some((run) => run.includes("npm pack ./hosts/openclaw"))).toBe(true);
         expect(runs).toContain('set -- skills .claude-plugin; for path in LICENSE LICENSE.md LICENSE.txt NOTICE NOTICE.md NOTICE.txt; do if [ -f "$path" ]; then set -- "$@" "$path"; fi; done; zip -qr dist/release/hello-plugin.zip "$@"');
         const webBuild = runs.findIndex((run) => run.includes("npm -C web run build"));

package/dist/toolfactory/cli.js

@@ -11,7 +11,7 @@ const operations = [...authored, web];
 const program = new Command()
     .name("toolfactory")
     .description("Build an agent tool once; ship it as Agent Skills, MCP servers, Agent Plugins / Claude / Codex / Cursor bundles, OpenClaw and Hermes plugins, CLIs, and packages, with the tests and releases to match.")
-    .version("0.1.1");
+    .version("0.2.0");
 for (const op of operations) {
     if (!serves(op, "cli"))
         continue;

package/dist/toolfactory/mcp.js

@@ -30,7 +30,7 @@ const operations = [...authored, web];
 const introspecting = Boolean(process.env.TOOLFACTORY_INTROSPECT);
 /** Builds one server instance with every servable operation registered; called once for stdio, once per HTTP request. */
 function createServer() {
-    const server = new McpServer({ name: "toolfactory", version: "0.1.1" });
+    const server = new McpServer({ name: "toolfactory", version: "0.2.0" });
     for (const op of operations) {
         if (!introspecting && !serves(op, "mcp"))
             continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolfactory",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Build an agent tool once; ship it as Agent Skills, MCP servers, Agent Plugins / Claude / Codex / Cursor bundles, OpenClaw and Hermes plugins, CLIs, and packages, with the tests and releases to match.",
   "license": "MIT",
   "repository": {
@@ -17,6 +17,7 @@
     "check": "biome check . && tsc -p tsconfig.json --noEmit",
     "format": "biome format --write .",
     "test": "vitest run --passWithNoTests",
+    "test:integration": "node --import tsx scripts/check-vscode.mjs",
     "toolfactory": "node --import tsx src/toolfactory/cli.ts",
     "vendor:template": "node --import tsx src/hosts/template.ts --write"
   },

package/src/bindings/python.ts

@@ -236,7 +236,7 @@ def env_route(token: "str | None") -> Route:
   return `
 
 def web_dist() -> "Path | None":
-    """The built page: the wheel force-includes \`${WEB_DIR}/dist\` here, a checkout has it in place."""
+    """The wheel maps \`${WEB_DIR}/dist\` here at package time; a checkout has it in place."""
     package = Path(__file__).resolve().parent.parent
     for candidate in (package / "${WEB_DIR}", package.parent.parent / "${WEB_DIR}" / "dist"):
         if candidate.is_dir():

package/src/distribution/native.test.ts

@@ -0,0 +1,161 @@
+import { describe, expect, it } from "vitest";
+import type { Project } from "../model.js";
+import {
+  nativeInstallLines,
+  nativePackageConfigSchema,
+  nativePackageSteps,
+  nativePublishJobs,
+  nativeRegistryRows,
+} from "./native.js";
+
+function project(
+  entries: unknown[],
+  surfaces = entries.map((entry) => (entry as { id: string }).id),
+): Project {
+  return {
+    root: "/repo",
+    tool: {
+      schemaVersion: 1,
+      identity: "package.json",
+      binding: "typescript",
+      surfaces: surfaces as unknown as Project["tool"]["surfaces"],
+      bundle: { runtime: "package" },
+      tests: { examples: {} },
+      nativePackages: entries,
+    } as unknown as Project["tool"],
+    identity: { name: "tool", version: "1.2.3", repository: "https://github.com/acme/tool" },
+    identityExtra: {},
+    operations: [],
+    toolfactoryVersion: "0.1.0",
+  };
+}
+const cargo = {
+  id: "cargo",
+  path: "native/cli",
+  identity: "Cargo.toml",
+  name: "acme-cli",
+  versionCommand: "cargo pkgid | sed 's/.*@//'",
+};
+
+describe("native package configuration", () => {
+  it("requires the package path, authored identity, and registry identity", () => {
+    expect(() => nativePackageConfigSchema.parse({ id: "cargo", path: "native" })).toThrow();
+    expect(nativePackageConfigSchema.parse(cargo)).toEqual(cargo);
+  });
+
+  it("rejects a selected registry with no config or duplicate configuration", () => {
+    expect(() => nativePackageSteps(project([], ["cargo"]))).toThrow(/requires exactly one/);
+    expect(() => nativePackageSteps(project([cargo, cargo]))).toThrow(/repeats/);
+  });
+
+  it("packages authored crates and checks their version against the release", () => {
+    const steps = nativePackageSteps(project([cargo]));
+    expect(steps.map((step) => step.name)).toEqual([
+      "cargo version matches release",
+      "Cargo crate",
+    ]);
+    expect(steps[0]?.run).toContain("= '1.2.3'");
+    expect(steps[1]?.run).toContain("cargo package --manifest-path 'native/cli/Cargo.toml'");
+    expect(steps[1]?.run).toContain("--target-dir 'dist/native-build/cargo'");
+    expect(steps[1]?.run).not.toContain("/repo");
+  });
+
+  it("reads structured Cargo metadata and the raw MSBuild version", () => {
+    const cargoDefault = {
+      id: "cargo",
+      path: "native/cli",
+      identity: "Cargo.toml",
+      name: "acme-cli",
+    };
+    const nuget = {
+      id: "nuget",
+      path: "dotnet",
+      identity: "Tool.csproj",
+      name: "Acme.Tool",
+    };
+    const steps = nativePackageSteps(project([cargoDefault, nuget]));
+    expect(steps[0]?.run).toContain(
+      "cargo metadata --no-deps --format-version 1 --manifest-path 'Cargo.toml'",
+    );
+    expect(steps[0]?.run).toContain("JSON.parse(s).packages.find");
+    expect(steps[2]?.run).toContain("dotnet msbuild 'Tool.csproj' -nologo -getProperty:Version");
+    expect(steps[2]?.run).not.toContain("sed -n");
+  });
+
+  it("leaves VCS-discovered Packagist and Go modules for the final release tag", () => {
+    const entries = [
+      {
+        id: "packagist",
+        path: ".",
+        identity: "composer.json",
+        name: "acme/tool",
+      },
+      {
+        id: "go-module",
+        path: ".",
+        identity: "go.mod",
+        name: "github.com/acme/tool",
+      },
+    ];
+    expect(nativePackageSteps(project(entries))).toEqual([]);
+    expect(nativeInstallLines(project(entries))).toEqual([
+      "`composer require acme/tool`",
+      "`go get github.com/acme/tool@v1.2.3`",
+    ]);
+  });
+
+  it("uses direct upstream publishing commands and exposes only their actual credentials", () => {
+    const entries = [
+      cargo,
+      {
+        id: "nuget",
+        path: "dotnet",
+        identity: "Tool.csproj",
+        name: "Acme.Tool",
+        versionCommand: "dotnet msbuild -getProperty:Version Tool.csproj",
+      },
+    ];
+    const jobs = nativePublishJobs(
+      project(entries),
+      "release-assets",
+      "${{ needs.gate.outputs.sha }}",
+    );
+    expect(jobs["publish-cargo"]?.steps).toContainEqual(
+      expect.objectContaining({ run: expect.stringContaining("cargo publish") }),
+    );
+    expect(jobs["publish-nuget"]?.steps).toContainEqual(
+      expect.objectContaining({ run: expect.stringContaining("dotnet nuget push") }),
+    );
+    expect(jobs["publish-nuget"]?.steps).toContainEqual(
+      expect.objectContaining({
+        uses: "actions/setup-dotnet@v5",
+        with: { "dotnet-version": "8.0.x" },
+      }),
+    );
+    expect(nativeRegistryRows(project(entries)).map((row) => row.secrets)).toEqual([
+      ["CARGO_REGISTRY_TOKEN"],
+      ["NUGET_API_KEY"],
+    ]);
+    expect(jobs["publish-cargo"]?.needs).toEqual(["gate", "package"]);
+    expect(jobs["publish-cargo"]?.if).toBe("needs.gate.outputs.cargo == 'true'");
+    expect(jobs["publish-cargo"]?.steps).not.toContainEqual(
+      expect.objectContaining({ uses: "dtolnay/rust-toolchain@stable" }),
+    );
+  });
+
+  it("builds a gem from its package directory before moving the resulting asset", () => {
+    const steps = nativePackageSteps(
+      project([
+        {
+          id: "rubygems",
+          path: "native/ruby",
+          identity: "acme.gemspec",
+          name: "acme",
+          versionCommand: "ruby -e 'puts 1.2.3'",
+        },
+      ]),
+    );
+    expect(steps[1]?.run).toContain("(cd 'native/ruby' && gem build --strict 'acme.gemspec')");
+    expect(steps[1]?.run).toContain("mv 'native/ruby/acme-1.2.3.gem'");
+  });
+});