triflux 10.41.0 → 10.41.1

package/bin/tfx-doctor.mjs

@@ -1,8 +1,13 @@
 #!/usr/bin/env node
 // tfx-doctor — triflux doctor 바로가기
+import { fileURLToPath } from "node:url";
+
 process.argv = [
   process.argv[0],
-  process.argv[1],
+  // triflux.mjs's own isMainModule() guard compares this against its real
+  // path, not this shim's — point argv[1] at triflux.mjs so it recognizes
+  // itself as the entry point instead of silently no-op'ing.
+  fileURLToPath(new URL("./triflux.mjs", import.meta.url)),
   "doctor",
   ...process.argv.slice(2),
 ];

package/bin/tfx-live.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { execFile } from "node:child_process";
+import { realpathSync } from "node:fs";
 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
 import { join as pathJoin, resolve as pathResolve } from "node:path";
@@ -2368,11 +2369,19 @@ export {
   resolveAskTransport,
 };
 
-const isDirectRun =
-  process.argv[1] &&
-  fileURLToPath(import.meta.url) === pathResolve(process.argv[1]);
+function isMainModule() {
+  if (!process.argv[1]) return false;
+  const modulePath = fileURLToPath(import.meta.url);
+  try {
+    return realpathSync(process.argv[1]) === modulePath;
+  } catch {
+    // process.argv[1] doesn't resolve on disk (e.g. `node -e`) — fall back
+    // to a non-symlink-aware comparison instead of treating it as not-main.
+    return pathResolve(process.argv[1]) === modulePath;
+  }
+}
 
-if (isDirectRun) {
+if (isMainModule()) {
   main().catch((error) => {
     printJson({
       ok: false,

package/bin/tfx-setup.mjs

@@ -1,8 +1,13 @@
 #!/usr/bin/env node
 // tfx-setup — triflux setup 바로가기
+import { fileURLToPath } from "node:url";
+
 process.argv = [
   process.argv[0],
-  process.argv[1],
+  // triflux.mjs's own isMainModule() guard compares this against its real
+  // path, not this shim's — point argv[1] at triflux.mjs so it recognizes
+  // itself as the entry point instead of silently no-op'ing.
+  fileURLToPath(new URL("./triflux.mjs", import.meta.url)),
   "setup",
   ...process.argv.slice(2),
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "triflux",
-  "version": "10.41.0",
+  "version": "10.41.1",
   "description": "CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude",
   "type": "module",
   "bin": {

package/scripts/__tests__/release-governance.test.mjs

@@ -165,7 +165,13 @@ describe("release governance scripts", () => {
       );
       assert.deepEqual(
         tagOnlyPublish.steps.map((step) => step.label),
-        ["git tag", "git push", "gh release create"],
+        [
+          "git tag",
+          "git push branch",
+          "git push tag",
+          "wait for tag",
+          "gh release create",
+        ],
       );
 
       const executed = [];
@@ -178,6 +184,9 @@ describe("release governance scripts", () => {
         execFileSyncFn: (command, args) => {
           executed.push([command, ...args].join(" "));
           if (command === "git" && args[0] === "rev-parse") return "tag\n";
+          if (command === "git" && args[0] === "ls-remote") {
+            return "abc123\trefs/tags/v1.2.3\n";
+          }
           if (command === "gh" && args[0] === "release") {
             return '{"tagName":"v1.2.3"}\n';
           }
@@ -187,7 +196,9 @@ describe("release governance scripts", () => {
       assert.equal(resumedPublish.allowExistingArtifacts, true);
       assert.deepEqual(executed, [
         "git rev-parse --verify v1.2.3",
-        "git push origin HEAD --tags",
+        "git push origin HEAD",
+        "git push origin v1.2.3",
+        "git ls-remote --tags origin v1.2.3",
         "gh release view v1.2.3 --json tagName",
       ]);
 
@@ -222,6 +233,41 @@ describe("release governance scripts", () => {
     }
   });
 
+  it("tag-only(CI) 모드는 preflight로 HEAD==origin/main을 검증하고 branch push를 생략한다", async () => {
+    const root = makeRepo();
+    const prevRef = process.env.GITHUB_REF_NAME;
+    process.env.GITHUB_REF_NAME = "main";
+    try {
+      assertVersionSync({ rootDir: root, fix: true });
+      const executed = [];
+      await publishRelease({
+        rootDir: root,
+        version: "1.2.3",
+        dryRun: false,
+        publishNpm: false,
+        pushBranch: false,
+        createGithubRelease: false,
+        tagPoll: { attempts: 1, sleepFn: async () => {} },
+        execFileSyncFn: (command, args) => {
+          executed.push([command, ...args].join(" "));
+          if (command === "git" && args[0] === "rev-parse") {
+            return "deadbeef\n";
+          }
+          return "";
+        },
+      });
+      assert.ok(executed.includes("git fetch origin main"));
+      assert.ok(executed.includes("git rev-parse HEAD"));
+      assert.ok(executed.includes("git rev-parse origin/main"));
+      assert.ok(executed.includes("git push origin v1.2.3"));
+      assert.ok(!executed.includes("git push origin HEAD"));
+    } finally {
+      if (prevRef === undefined) delete process.env.GITHUB_REF_NAME;
+      else process.env.GITHUB_REF_NAME = prevRef;
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
   it("release workflows use trusted publishing and skip duplicate tag publishes", () => {
     const releaseWorkflow = readFileSync(
       new URL("../../.github/workflows/release.yml", import.meta.url),
@@ -230,6 +276,7 @@ describe("release governance scripts", () => {
     assert.match(releaseWorkflow, /actions:\s*write/);
     assert.match(releaseWorkflow, /node-version:\s*24/);
     assert.match(releaseWorkflow, /publish\.mjs.*--skip-npm.*--allow-existing/);
+    assert.match(releaseWorkflow, /publish\.mjs.*--tag-only/);
     assert.match(
       releaseWorkflow,
       /gh workflow run npm-publish\.yml --ref \$\{\{ github\.ref_name \}\}/,

package/scripts/release/publish.mjs

@@ -3,6 +3,40 @@ import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { assertVersionSync, parseArgs, ROOT, runCommand } from "./lib.mjs";
 
+const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+export async function waitForRemoteTag(
+  tagName,
+  {
+    rootDir = ROOT,
+    execFileSyncFn,
+    attempts = 30,
+    intervalMs = 2000,
+    sleepFn = defaultSleep,
+  } = {},
+) {
+  for (let attempt = 0; attempt < attempts; attempt++) {
+    try {
+      const out = runCommand(
+        "git",
+        ["ls-remote", "--tags", "origin", tagName],
+        {
+          cwd: rootDir,
+          execFileSyncFn,
+          stdio: "pipe",
+        },
+      );
+      if (String(out).includes(`refs/tags/${tagName}`)) return true;
+    } catch {
+      // Transient network/auth blips are retried below.
+    }
+    if (attempt < attempts - 1) await sleepFn(intervalMs);
+  }
+  throw new Error(
+    `Tag ${tagName} not visible on origin after ${attempts} attempts`,
+  );
+}
+
 export async function publishRelease({
   version,
   rootDir = ROOT,
@@ -12,6 +46,8 @@ export async function publishRelease({
   publishNpm = true,
   provenance = false,
   allowExistingArtifacts = false,
+  pushBranch = true,
+  tagPoll = {},
   execFileSyncFn,
 } = {}) {
   const sync = assertVersionSync({ rootDir });
@@ -73,14 +109,27 @@ export async function publishRelease({
         }))
       : []),
     { label: "git tag", command: "git", args: ["tag", `v${releaseVersion}`] },
-    {
-      label: "git push",
-      command: "git",
-      args: ["push", "origin", "HEAD", "--tags"],
-    },
   ];
+  if (pushBranch) {
+    steps.push({
+      label: "git push branch",
+      command: "git",
+      args: ["push", "origin", "HEAD"],
+    });
+  }
+  steps.push({
+    label: "git push tag",
+    command: "git",
+    args: ["push", "origin", `v${releaseVersion}`],
+  });
 
   if (createGithubRelease) {
+    steps.push({
+      label: "wait for tag",
+      kind: "wait-tag",
+      command: "git",
+      args: ["ls-remote", "--tags", "origin", `v${releaseVersion}`],
+    });
     steps.push({
       label: "gh release create",
       command: "gh",
@@ -125,11 +174,45 @@ export async function publishRelease({
   };
 
   if (!dryRun) {
+    if (!pushBranch) {
+      const branch = process.env.GITHUB_REF_NAME || "main";
+      runCommand("git", ["fetch", "origin", branch], {
+        cwd: rootDir,
+        execFileSyncFn,
+      });
+      const head = String(
+        runCommand("git", ["rev-parse", "HEAD"], {
+          cwd: rootDir,
+          execFileSyncFn,
+          stdio: "pipe",
+        }),
+      ).trim();
+      const remote = String(
+        runCommand("git", ["rev-parse", `origin/${branch}`], {
+          cwd: rootDir,
+          execFileSyncFn,
+          stdio: "pipe",
+        }),
+      ).trim();
+      if (head !== remote) {
+        throw new Error(
+          `Refusing tag-only publish: HEAD ${head} != origin/${branch} ${remote} (stale checkout or unpushed ${branch})`,
+        );
+      }
+    }
     for (const step of steps) {
       const tagName = `v${releaseVersion}`;
       if (step.label === "git tag" && shouldSkipExistingTag(tagName)) {
         continue;
       }
+      if (step.kind === "wait-tag") {
+        await waitForRemoteTag(tagName, {
+          rootDir,
+          execFileSyncFn,
+          ...tagPoll,
+        });
+        continue;
+      }
       if (
         step.label === "gh release create" &&
         shouldSkipExistingGithubRelease(tagName)
@@ -151,6 +234,7 @@ export async function publishRelease({
     publishNpm,
     provenance,
     allowExistingArtifacts,
+    pushBranch,
     dryRun,
     notesPath,
     steps: steps.map((step) => ({
@@ -175,6 +259,7 @@ if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
     publishNpm: !args["skip-npm"],
     provenance: Boolean(args.provenance || envProvenance),
     allowExistingArtifacts: Boolean(args["allow-existing"]),
+    pushBranch: !args["tag-only"],
   });
   console.log(JSON.stringify(result, null, 2));
 }