fix(npm): let an unproven package name fail without failing the release - #14
Merged
Conversation
v0.9.0 died on `403 — Package name too similar to existing package cp-cli`. npm applies a typosquatting similarity check that runs only on a real publish: `npm view scc-cli` returned 404 and `npm publish --dry-run` passed, and neither says anything about it. Because the rejected name published first, `set -e` took `@protonspy/scc` down with it — six platform packages reached the registry at 0.9.0 with no launcher that resolves them, and no tag was cut. LAUNCHERS entries now carry `required`, and the tiers are directories so both publish order and failure policy are visible in the layout: dist/scc-*/, then dist/launchers/, then dist/launchers-optional/. A required name is already ours and a failure there is real; an unproven one is attempted last and warns. The corollary is the load-bearing half: only a required name may appear in documentation, the embedded entry.md included. Pointing an install line at a package that might be refused is the same bug somewhere more expensive, so the docs go back to @protonspy/scc and `spec-claude-code-cli` ships untested and undocumented. Promote it in the release after the one that proves it publishes. Template version stays 9 rather than bumping: no v0.9.0 binary is reachable — the tag and GitHub Release steps were skipped, and no launcher on the registry resolves the orphaned platform packages — so the v9 that named scc-cli never shipped to anyone and is corrected in place. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J54qbk8RpC2tZH8LBz6T2b
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Recovery for the failed v0.9.0.
What happened
npm's typosquatting similarity check runs only on a real publish.
npm view scc-clireturned 404 andnpm publish --dry-runpassed — neither exercises it. Both were reported as proof the name was free; neither was.scc-cliwas first inLAUNCHERS, soset -etook@protonspy/sccdown with it.State it left behind
@protonspy/sccscc-cliNo user-facing breakage: the 0.8.0 path is intact, and nothing resolves the orphans.
The fix
LAUNCHERSentries carryrequired, and the tiers are directories so publish order and failure policy are visible in the layout:Only a required name may appear in documentation — the
entry.mdembedded in six binaries included. Pointing an install line at a package that might be refused is the same bug somewhere more expensive. So docs return to@protonspy/scc, andspec-claude-code-cliships untested and undocumented; the release after the one that proves it publishes can promote it.Template version stays
9. No v0.9.0 binary is reachable — tag and Release were skipped, and no launcher resolves the orphaned platform packages — so the v9 that namedscc-clinever shipped and is corrected in place rather than bumped.Verified
scc-clileft anywhere outside the incident write-ups.gofmt,go vet,go test ./...,node --checkall clean.Next release is v0.9.1 — 0.9.0's platform packages are immutable and stay orphaned.
🤖 Generated with Claude Code
https://claude.ai/code/session_01J54qbk8RpC2tZH8LBz6T2b