chore(pkg): release hygiene - dep pins, metadata, tarball, gates

.github/workflows/publish.yml

@@ -47,7 +47,7 @@ jobs:
 
           # Match squash merges from release/* branches or release prepare commits
           # Match: merge commits from release/*, squash merges (PR title "Release v..."), or release prepare commits
-          if echo "$COMMIT_MSG" | grep -qE "(^Merge pull request .* from .*/release/|^Release v|^chore: prepare release)"; then
+          if echo "$COMMIT_MSG" | grep -qE "(^Merge pull request .* from .*/release/|^Release v|^chore: prepare release|^chore\(release\))"; then
             echo "is-release=true" >> $GITHUB_OUTPUT
             echo "✅ Release commit detected — proceeding with publish"
           else

CLAUDE.md

@@ -26,8 +26,8 @@ its agent-runtime patterns (the local memory daemon was deliberately ported from
   `spawn git` directly (memory-core's createGit is private); no new deps. `vault sync [name]`
   forces a cycle via the daemon (`/api/sync/run`) or in-process when it is down
 - `src/package-guard.test.ts` - CI guard: no agent-runtime remnants (express/ws/sqlite/
-  core/platform/supabase), runtime deps stay exactly `@agentage/memory-core + chalk +
-  commander + open`
+  core/platform/supabase), runtime deps stay exactly `@agentage/memory-core +
+  @agentage/server-memory + @modelcontextprotocol/sdk + chalk + commander + open`
 
 ## Auth model
 Fresh DCR public client per `setup` run (the redirect URI binds the ephemeral callback

package.json

@@ -4,11 +4,20 @@
   "description": "The agentage CLI - connect this machine to agentage from the terminal",
   "type": "module",
   "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "bin": {
     "agentage": "./dist/cli.js"
   },
+  "author": "Volodymyr Vreshch",
+  "publishConfig": {
+    "access": "public"
+  },
+  "bugs": {
+    "url": "https://github.com/agentage/cli/issues"
+  },
   "files": [
-    "dist"
+    "dist",
+    "CHANGELOG.md"
   ],
   "engines": {
     "node": ">=22.0.0",
@@ -34,9 +43,9 @@
     "@agentage/memory-core": "^0.3.2",
     "@agentage/server-memory": "^0.0.3",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "chalk": "latest",
-    "commander": "latest",
-    "open": "latest"
+    "chalk": "^5.6.2",
+    "commander": "^14.0.3",
+    "open": "^11.0.0"
   },
   "devDependencies": {
     "@anthropic-ai/sdk": "0.110.0",

scripts/bump-version.js

@@ -41,6 +41,11 @@ switch (bumpType) {
     break;
 }
 
+// 0.1.19 is a permanently burned npm slot (unpublished); publishing it hard-403s, so skip it.
+if (newVersion === '0.1.19') {
+  newVersion = '0.1.20';
+}
+
 pkg.version = newVersion;
 writeFileSync(packagePath, JSON.stringify(pkg, null, 2) + '\n');
 

src/cli.ts

@@ -13,6 +13,13 @@ import { disableDaemon } from './lib/daemon-pref.js';
 import { refreshUpdateCache, updateHint } from './lib/update-cache.js';
 import { VERSION } from './utils/version.js';
 
+// Dependency-free guard so the message survives even if deps fail to parse on old Node.
+const nodeMajor = Number(process.versions.node.split('.')[0]);
+if (nodeMajor < 22) {
+  process.stderr.write(`agentage requires Node.js >= 22 (you have v${process.versions.node})\n`);
+  process.exit(1);
+}
+
 const program = new Command();
 
 program

src/package-guard.test.ts

@@ -52,6 +52,15 @@ describe('package guard (R6)', () => {
     expect(pkg.bin['agentage']).toBe('./dist/cli.js');
   });
 
+  it('no runtime dependency uses the "latest" specifier', () => {
+    const pkg = JSON.parse(readFileSync(PKG, 'utf-8')) as {
+      dependencies: Record<string, string>;
+    };
+    for (const [name, spec] of Object.entries(pkg.dependencies)) {
+      expect(spec, `${name} must pin a semver range, not "latest"`).not.toBe('latest');
+    }
+  });
+
   it('homepage is set to the canonical site URL', () => {
     const pkg = JSON.parse(readFileSync(PKG, 'utf-8')) as { homepage: string };
     expect(pkg.homepage).toBe('https://agentage.io');

tsconfig.build.json

@@ -1,4 +1,8 @@
 {
   "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "sourceMap": false,
+    "declarationMap": false
+  },
   "exclude": ["node_modules", "dist", "coverage", "src/**/*.test.ts"]
 }