release: 2.0.0 — the Action is the only install path, and the CLI drops itself - #44
Merged
Conversation
…ps itself Cuts the release that carries #41 (App mode gone from the skill) and #42 (reactions on the default token, judge model from the recipe), and fixes a dependency the package should never have had. THE PACKAGE DEPENDED ON ITSELF. 1.1.0 added `@orcarouter/code-review: ^1.0.2` to its own `dependencies` and five releases carried it. Every `npx` therefore downloaded a second, older copy of the CLI into node_modules before running the one it came for — latency on the first thing a new user does, and RELEASE.md already said the CLI has no dependencies. Nothing failed, which is why it survived: the bin resolves from the top level, so the nested copy is dead weight rather than a wrong entry point. A self-reference is also a registry dependent, and npm reads dependents when deciding whether a version may be withdrawn. Pinned by a test rather than a note — `dependencies`, `peerDependencies` and `optionalDependencies` must all be empty. The invariant was already documented in prose and still broken for five releases. 2.0.0, not 1.5.1. 1.5.0 shipped the App-mode removal as a minor, and the 1.x line is being unpublished inside npm's 72-hour window, so 2.0.0 is the first version on the registry that a user can actually install — the major is where the break belongs, and a lone `1.5.1` would imply a history the packument no longer has. RELEASE.md records what went with the withdrawn versions, because a packument with one version reads as a truncated upload. It also says plainly that unpublishing was defensible only for a two-day-old line with no known consumers, and that deprecation is the default everywhere else. Three versions move together (gate 1): package.json, plugin.json, marketplace.json.
This was referenced Aug 26, 2026
akf66
added a commit
that referenced
this pull request
Aug 26, 2026
The 1.x section was written between deciding to unpublish the line and finding out npm would not allow it, and it shipped in #44 claiming "1.0.2 through 1.5.0 were published on 25-26 Aug 2026 and unpublished inside npm's 72-hour window." They are all still on the registry. Anyone reading that section would conclude the packument had one version in it and go looking for a bug when it has ten. What actually happened: all nine are deprecated, so they stay installable for anyone pinned and warn on every fresh install, pointing at @latest. That is the outcome the section should have described in the first place — the reasoning it gave for preferring deprecation was already sitting in its own last paragraph. Also records that the unscoped `orcacode-review` deprecation is still undone, which the file has prescribed since the org move without saying it had never been run. It cannot be run from CI: NPM_TOKEN is scoped to this one package, which is exactly the property that makes a leak survivable, so the command needs the personal account that owns the name.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cuts the release that carries #41 (App mode gone from the skill) and #42, and fixes a dependency the package should never have had.
The package depended on itself
1.1.0 added
@orcarouter/code-review: ^1.0.2to its owndependencies, and 1.1.0 → 1.5.0 all shipped it. Everynpx @orcarouter/code-reviewdownloaded a second, older copy of the CLI intonode_modulesbefore running the one it came for — latency on the first thing a new user does, against aRELEASE.mdthat already said the CLI has no dependencies.Nothing failed, which is why it survived five releases: the bin resolves from the top level, so the nested copy was dead weight rather than a wrong entry point. It is also a registry dependent, and npm reads dependents when deciding whether a version may be withdrawn.
Pinned by a test now, not a note —
dependencies,peerDependenciesandoptionalDependenciesmust all be empty.2.0.0, not 1.5.1
1.5.0 shipped the App-mode removal as a minor. The 1.x line is being unpublished inside npm's 72-hour window, so 2.0.0 is the first version on the registry a user can install. The major is where the break belongs, and a lone
1.5.1would imply a history the packument no longer has.RELEASE.mdrecords what went with the withdrawn versions (App mode, the self-dependency), and says plainly that unpublishing was defensible only for a two-day-old line with no known consumers — deprecation is the default everywhere else.Release mechanics
package.json,.claude-plugin/plugin.json,.claude-plugin/marketplace.json.publish.yml, which publishes 2.0.0 after gates 1–5 and proves it public with gate 6.bin/+ the skill, 14 files.