[HeyGarrison]

Summary

rgstr becomes usable by an agent without a shell, and every failure says its next step.

Repository → pnpm workspace. @rgstr/cli moves to packages/cli (unchanged bin, files, tests; its build copies the root skills/ in so the npm tarball still ships the skill), @rgstr/mcp 0.0.1 is packages/mcp. Changesets' root package can't be versioned in a workspace, hence two package dirs. CI/release workflows run the same root scripts (pnpm build/test/typecheck/lint are now pnpm -r). First publish of @rgstr/mcp needs the npm trusted publisher (or a token) added for the new package name.

CLI flows become importable (packages/cli/src): claim-flow.ts (resolveClaimTargets → planClaims → applyClaims, plus checkOne, previewJson, outcomeJson), route-flow.ts (planRoutes → renderRoutePlan → applyRoutes), check-flow.ts (checkProject), api-types.ts. index.ts keeps commander + prompting only. The human lines go through a say: Say callback — the terminal in the CLI, a collected plan in MCP — so the plan the MCP returns is byte-for-byte what rgstr claim prints. No behaviour change; cli.test.ts is unchanged except for the new error tests.

Errors print their next step.

class RgstrApiError { status; code?: string; hint?: string; requestId?: string; get details() }
toErrorEnvelope(err) → { error, status, code?, hint?, requestId? }   // --json
renderError(env)     → "Error: <error>\n<hint>"                       // hint is the last line

claim --check reads the platform's new 422 proof_not_found (outcome in details) as "no proof found yet" and prints its hint.

@rgstr/mcp (@modelcontextprotocol/sdk pinned 1.32.1, stdio). Tools: rgstr_whois, rgstr_search, rgstr_check, rgstr_claim_plan/rgstr_claim_apply, rgstr_claim_check, rgstr_setup_plan/rgstr_setup_apply, rgstr_route_plan/rgstr_route_apply, rgstr_login. Plan tools return the CLI's plan text + JSON with a plan_id; apply takes only that plan_id and applies exactly that plan, once — there is no apply without a plan. A plan whose files (README / .npmrc / pip.conf, byte fingerprint), organization or host changed since it was shown answers isError code plan_stale, hint "Run rgstr__plan again and show the user the new plan", and writes nothing. Every apply description and the server instructions carry the rule from SKILL.md / llms.txt: show the user the plan, get confirmation, then apply. Auth is the CLI's stored device login (RGSTR_HOME), RGSTR_TOKEN/RGSTR_ORG/RGSTR_URL honoured; rgstr_login runs device-code and, like rgstr login, makes the user's one organization the active one via the shared packages/cli/src/login.ts — if /api/v1/me fails after approval, both forget the previously stored organization and answer no_organization ("Signed in, but no organization was selected; run rgstr org use <slug>"); no credentials → { error: "Not logged in.", code: "no_credentials", hint: "Run npx @rgstr/cli@latest login" }. Errors are isError results: the JSON envelope first, then the renderError text, so the hint is the last line as in the CLI.

Tests (packages/mcp/src/__tests__/server.test.ts, in-memory transport, mocked fetch): tool list + rule text, whois/search, claim_plan posts/writes nothing, claim_apply = exactly one POST /api/v1/registry/claims and the badge with the real token, plan_id single-use and required, plan_stale on a README/config edit or organization change since the plan, no-credentials message, route/setup plan→apply; login.test.ts covers the organization selection and the failed-lookup path. Docs: packages/mcp/README.md (Claude Desktop / Cursor / Devin config), skills/rgstr/SKILL.md "Without a shell: MCP" section + errors rule (mirrored in benchmarks-platform's lib/registry/skill.ts on the companion PR), changesets for both packages.

Companion: computesdk/benchmarks-platform "rgstr API: every 4xx names its next step".

Stdio against prod

node packages/mcp/scripts/stdio-smoke.mjs computesdk (initialize → tools/list → tools/call):

# initialize → {"serverInfo":{"name":"rgstr","version":"0.0.1"},"instructions":"rgstr (https://rgstr.org) is the package name registry over npm and PyPI: who claims a name, how much to trust it, and where installs of it are served from. …"}
# tools/list → rgstr_whois, rgstr_search, rgstr_check, rgstr_claim_plan, rgstr_claim_apply, rgstr_claim_check, rgstr_setup_plan, rgstr_setup_apply, rgstr_route_plan, rgstr_route_apply, rgstr_login
# tools/call rgstr_whois computesdk →
{
  "name": "computesdk",
  "url": "https://rgstr.org/registry/computesdk",
  "trust": "claimed",
  "state": "held",
  "holder": {
    "name": "ComputeSDK",
    "slug": "computesdk",
    "url": "https://rgstr.org/~computesdk",
    "via": "computesdk",
    "kind": "package",
    "status": "verified"
  },
  "routes": [],
  "relationship": null,
  "hiddenCopies": null
}

Link to Devin session: https://app.devin.ai/sessions/fe389c0a51364fe5bf8a7724b7049bc9
Open in Devin Desktop: https://app.devin.ai/desktop/session/fe389c0a51364fe5bf8a7724b7049bc9?variant=devin
Requested by: @HeyGarrison

Link to Devin session: https://app.devin.ai/sessions/fe389c0a51364fe5bf8a7724b7049bc9
Open in Devin Desktop: https://app.devin.ai/desktop/session/fe389c0a51364fe5bf8a7724b7049bc9?variant=devin
Requested by: @HeyGarrison

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin resolved all 11 findings on d8e33c8

Fixed by Devin (11)

• Device login leaves organization unset
• Concurrent logins lose a registry's credentials
• Completed login still prompts for approval
• Concurrent login loses tool errors
• Login guidance points to another host
• Claim plan promises an impossible pull request
• Badge pull requests become unreachable
• Changed setup configuration still gets deleted
• Stored plans can target another organization
• Failed login hangs the tool call
• MCP hints lose last-line placement

View all findings in Devin Review