Sync from monorepo (v2026.916.3)

.github/workflows/helm.yml

@@ -151,17 +151,49 @@ jobs:
 
       - name: Log in to GHCR
         if: github.event_name != 'workflow_dispatch' || inputs.dry-run == false
-        run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io -u "${{ github.actor }}" --password-stdin
+        run: |
+          set -euo pipefail
+          echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io -u "${{ github.actor }}" --password-stdin
+          # oras uses its own (docker-style) credential store, separate from
+          # helm's — needed so the push step can verify via `oras resolve`
+          # against a package that may still be private.
+          echo "${{ secrets.GITHUB_TOKEN }}" | oras login ghcr.io -u "${{ github.actor }}" --password-stdin
 
       - name: Push to OCI registry
         id: push
         if: github.event_name != 'workflow_dispatch' || inputs.dry-run == false
         run: |
-          set -euo pipefail
-          helm push "vibgrate-${{ steps.chart.outputs.version }}.tgz" "${OCI_REPO}" 2> push.log
-          cat push.log
-          digest=$(grep -oE 'sha256:[0-9a-f]{64}' push.log | head -1)
-          if [ -z "${digest}" ]; then echo "::error::could not determine pushed digest"; exit 1; fi
+          set -uo pipefail
+          ref="${CHART_REF}:${{ steps.chart.outputs.version }}"
+          attempts=5
+          digest=""
+          for i in $(seq 1 "${attempts}"); do
+            if helm push "vibgrate-${{ steps.chart.outputs.version }}.tgz" "${OCI_REPO}" 2> push.log; then
+              push_ok=true
+            else
+              push_ok=false
+            fi
+            cat push.log
+            # GHCR/helm push can report a transient error on the final manifest
+            # step even though the chart already landed — verify against the
+            # registry itself rather than trusting helm's exit code alone.
+            digest="$(oras resolve "${ref}" 2>/dev/null || true)"
+            if [ -n "${digest}" ]; then
+              if [ "${push_ok}" = "false" ]; then
+                echo "::warning::helm push reported an error but ${ref} is present in the registry (verified via oras resolve) — treating as success."
+              fi
+              break
+            fi
+            if [ "${i}" -lt "${attempts}" ]; then
+              delay=$((5 * i))
+              echo "::warning::helm push attempt ${i}/${attempts} did not land — retrying in ${delay}s."
+              sleep "${delay}"
+            fi
+          done
+          if [ -z "${digest}" ]; then
+            echo "::error::helm push did not succeed after ${attempts} attempts"
+            exit 1
+          fi
           echo "digest=${digest}" >> "$GITHUB_OUTPUT"
 
       - name: Make GHCR chart package public

.github/workflows/packaging.yml

@@ -48,13 +48,14 @@ concurrency:
 
 permissions:
   contents: write # commit refreshed stamps back to main when they change
+  actions: read # poll this commit's Release run status on the push trigger
 
 jobs:
   publish:
     name: Stamp and publish tap + bucket
     if: github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success'
     runs-on: ubuntu-latest
-    timeout-minutes: 10
+    timeout-minutes: 25
     steps:
       - name: Checkout
         uses: actions/checkout@v7
@@ -64,6 +65,39 @@ jobs:
         with:
           node-version: 24
 
+      # The `push` trigger above (for packaging/** or stamp-script edits) fires
+      # on the SAME push event as release.yml's own `push: branches: [main]`
+      # trigger — there is no `needs:`/ordering between the two workflows, so
+      # a sync commit that both bumps package.json's version AND touches
+      # packaging/** can start this job before (or while) the Release job is
+      # still building/publishing. Only the workflow_run trigger is naturally
+      # ordered after a publish; for the push path, explicitly wait for this
+      # commit's Release run to finish so we don't race it.
+      - name: Wait for this commit's Release run (npm publish)
+        if: github.event_name == 'push'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          sha="${{ github.sha }}"
+          for i in $(seq 1 80); do
+            status="$(gh run list --repo "${{ github.repository }}" --workflow=release.yml --commit "${sha}" --json status --jq '.[0].status // "none"' 2>/dev/null || echo "none")"
+            case "${status}" in
+              completed)
+                echo "Release run for ${sha} completed — continuing."
+                exit 0
+                ;;
+              none)
+                echo "No Release run found yet for ${sha} (attempt ${i}/80)."
+                ;;
+              *)
+                echo "Release run for ${sha} is ${status} (attempt ${i}/80)."
+                ;;
+            esac
+            sleep 15
+          done
+          echo "::warning::Gave up waiting for the Release run on ${sha} after 20 minutes — proceeding anyway; the tarball download retry below is the fallback."
+
       - name: Stamp formula and manifest
         id: stamp
         env:

action.yml

@@ -46,7 +46,7 @@ inputs:
   image-tag:
     description: 'Scanner image tag to run (defaults to a pinned, tested release).'
     required: false
-    default: '2026.916.2' # vibgrate:cli-version — stamped by scripts/stamp-release-pins.mjs
+    default: '2026.916.3' # vibgrate:cli-version — stamped by scripts/stamp-release-pins.mjs
   verify:
     description: 'Verify the image cosign signature + provenance before running (requires cosign on the runner).'
     required: false

charts/vibgrate/Chart.yaml

@@ -7,7 +7,7 @@ type: application
 # stamped to the released @vibgrate/cli calendar version by
 # scripts/stamp-release-pins.mjs (via the marker on the appVersion line below).
 version: 0.1.2
-appVersion: "2026.916.2" # vibgrate:cli-version — stamped by scripts/stamp-release-pins.mjs
+appVersion: "2026.916.3" # vibgrate:cli-version — stamped by scripts/stamp-release-pins.mjs
 home: https://vibgrate.com
 icon: https://vibgrate.com/web-app-manifest-512x512.png
 sources:

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibgrate/cli",
-  "version": "2026.916.2",
+  "version": "2026.916.3",
   "description": "vg — local codebase intelligence CLI + MCP server for AI coding agents: deterministic code graph, drift reporting, and version-correct library docs (Apache-2.0)",
   "//mcpName": "Official MCP registry ownership proof: the registry fetches the published npm package and requires this field to match the com.vibgrate/ai-context server entry (see docs/marketing/mcp-registry/README.md). Must ship in the published @vibgrate/cli package.json.",
   "mcpName": "com.vibgrate/ai-context",

releases/v2026.916.3.md

@@ -0,0 +1,42 @@
+# Vibgrate CLI 2026.916.3
+
+_Released 2026-09-16_
+
+Routine maintenance update for the CLI.
+
+## What changed
+
+### Changed
+
+- Maintenance release with internal improvements and dependency updates.
+
+## Benchmarks
+
+Two-arm benchmark of this release against 2026.916.2, interleaved on one runner against the pinned corpus (236 metrics compared).
+
+| Metric | Previous | This release |
+| --- | --- | --- |
+| Languages with extraction | 19 count | 19 count |
+| Definitions extracted (corpus total) | 25690 count | 25690 count |
+| Call edges extracted (corpus total) | 17316 count | 17316 count |
+| Locate accuracy (top-1) | 0.94 ratio | 0.94 ratio |
+| Dependency detection (authored manifest truth) | 0.96 ratio | 0.96 ratio |
+| CLI startup (--version, median) | 478.80 ms | 476.90 ms |
+
+5 regression(s) — published, not omitted:
+- Token reduction vs baseline agent (equal success): 0.37 → 0.23 (-37.3%)
+- Tasks passed on both arms: 36 → 35 (-2.8%)
+- Comparable-task rate (both arms passed / total): 0.95 → 0.92 (-2.8%)
+- Agent tokens with vg (comparable tasks, total): 507315 → 603265 (18.9%)
+- Tool calls per task with vg (median, comparable tasks): 6 → 7 (16.7%)
+
+Full report and methodology: https://vibgrate.com/cli/benchmarks
+
+## Install or update
+
+```sh
+npm install -g @vibgrate/cli
+vg
+```
+
+Full changelog: https://vibgrate.com/changelog/cli/2026.916.3

scripts/stamp-packaging.mjs

@@ -59,7 +59,15 @@ export function stampScoop(template, { version, sha256, tarballUrl }) {
   return out;
 }
 
-export async function sha256OfUrl(url, { retries = 4, fetchImpl = fetch } = {}) {
+// npm registry propagation after `npm publish` is eventually consistent — the
+// tarball can 404 for a couple of minutes even after the Release workflow's
+// publish step reports success. Retry generously (default ~4.5 minutes of
+// total backoff) before giving up, so a normal propagation lag doesn't fail
+// the packaging job.
+export async function sha256OfUrl(
+  url,
+  { retries = 8, fetchImpl = fetch, baseDelayMs = 5000, maxDelayMs = 60_000 } = {},
+) {
   let lastErr;
   for (let attempt = 1; attempt <= retries; attempt += 1) {
     try {
@@ -82,7 +90,9 @@ export async function sha256OfUrl(url, { retries = 4, fetchImpl = fetch } = {})
     } catch (err) {
       lastErr = err;
       if (attempt < retries) {
-        await new Promise((r) => setTimeout(r, 1000 * 2 ** (attempt - 1)));
+        const delay = Math.min(maxDelayMs, baseDelayMs * 2 ** (attempt - 1));
+        console.warn(`stamp-packaging: ${err instanceof Error ? err.message : err} (attempt ${attempt}/${retries}, retrying in ${delay}ms)`);
+        await new Promise((r) => setTimeout(r, delay));
       }
     }
   }

src/version.ts

@@ -1,2 +1,2 @@
 // Calendar version (YYYY.DDD.PATCH), shared scheme with @vibgrate/cli.
-export const VERSION = '2026.916.2';
+export const VERSION = '2026.916.3';