Publish the toolchain, and make the pack it installs runnable - #16
Merged
Merged
Conversation
`@miakapp/cli` and `@miakapp/component` were `private: true`, so the agent pack pointed at a toolchain that did not exist anywhere an owner could reach. Both are now publishable, and both carry the LICENSE their `files` list already promised but never shipped. `publishConfig.tag` drops to the default on the two scoped packages. It said `next`, which is right for `miakapi` — that package has production users on `latest` 3.0.31 and the V4 alpha must not displace them — and wrong for a package whose only release is that alpha: with no `latest` tag at all, `npx @miakapp/cli` resolves nothing. The pack's MCP entry named a bare `miakapp` binary, reasoning that a name travels between machines where an absolute path does not. The reasoning holds; the conclusion did not survive a rehearsal in a fresh repository, where the binary is simply absent and the server never starts. It now runs `npx -y @miakapp/cli@<version> mcp`, which is equally portable and brings its own tool. The version is pinned so the guide written beside it is the guide of the release that answers. That pins a version into someone else's repository, which makes the hand-kept `CLI_VERSION` constant load-bearing rather than cosmetic, so it moves into `src/version.ts` beside `PACKAGE_NAME` and a test compares both to the manifest. The constants cannot live in `main.ts`: it imports `agent-pack.ts`, which now needs them. Verified against the registry rather than asserted: the `.mcp.json` this writes boots the published package over stdio and answers `initialize` with `serverInfo.version` 4.0.0-alpha.0. Four negative controls — bare binary, drifted version, drifted name, leaked absolute path — each go red and revert clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
@miakapp/cli@4.0.0-alpha.0,@miakapp/component@4.0.0-alpha.0andmiakapi@4.0.0-alpha.0are published. This PR is the repository state that produced them, plus the defect that publishing exposed.Publication
latestnextmiakapi@miakapp/cli@miakapp/componentpublishConfig.tagstaysnextonmiakapiand drops to the default on the two scoped packages. A package whose only release is a prerelease and which carries nolatesttag cannot be resolved by name, andnpx @miakapp/cliis exactly what the pack tells a client to run.Both scoped packages listed
LICENSEinfilesand shipped without one. Added.miakapipublish printedPublishing … with tag latestand returnedPUT 202+exit 0; the registry showsnext→ 4.0.0-alpha.0 withlateststill 3.0.31, which is correct. The CLI notice is not authoritative on a 202 — only the packument is. Worth knowing before someone panics about a production tag.The defect publishing exposed
Rehearsed in a fresh owner repository, against the published package:
agent-packwrites an.mcp.jsonnaming a baremiakappbinary. Nobody installed it, so the server never starts — the pack equips a repository with a tool that cannot run.The original reasoning is in the code comment and it was sound: a name travels between machines, an absolute path does not. The conclusion did not survive contact. The entry now runs
npx -y @miakapp/cli@<version> mcp— portable and self-installing — with the version pinned so the guide written beside it belongs to the release that answers.That writes a version into someone else's repository, which turns the hand-kept
CLI_VERSIONliteral from cosmetic into load-bearing. It moves tosrc/version.tsnext toPACKAGE_NAME, with a test comparing both to the manifest. They cannot stay inmain.ts, which importsagent-pack.ts.The old test asserting the bare name is replaced, not deleted — same property (portability), an assertion that can now be satisfied.
Verification
End-to-end against the registry, not asserted: the
.mcp.jsonthis writes boots the published package over stdio and answersinitializewithserverInfo.version4.0.0-alpha.0.Four negative controls, each red then reverted clean: bare binary name, drifted
CLI_VERSION, driftedPACKAGE_NAME, absolute path leaked into the entry.Bun 1.2.23 (the CI pin): root
check301 pass / 0 fail,check:packagesgreen — cli 119, component 38, template 8.Still open — the F gate does not close yet
Publishing was necessary, not sufficient. The same rehearsal found two more holes, both now unblocked:
templates/home", and referencespackages/cli/README.md,templates/home/README.md,docs/rfcs/*andcomponent-runtime/src/— none of which exist in the owner's repository.miakapp initwritesmiakapp.yamland nothing else, so there is no project tocheck.templates/homeis 9 files and 28 kB. Shipping it as a CLI asset and havinginitscaffold it — with the same byte-equality guard the guide asset already uses, minus the dependency block, which must move fromfile:to the published versions — closes both. That is the next unit.