[sqcode06]

Summary

• harden the versioned CLI ↔ Worker API contract and credential boundaries
• make @sqcode/conduit package/install behavior deterministic and test the exact tarball
• add CI and publication gates, pinned Actions, release documentation, and a reusable release-gate skill
• reject changing upload sources and unsafe destructive ID-prefix resolution

Why

This prepares the first npm release as one usable product: the packaged CLI plus its matching self-hosted Worker. It closes the blockers found by independent artifact, integration, security, cold-user, and verification reviews.

Validation

• clean release gate on Node 22.19.0
• Worker: 33 tests passed
• CLI: 27 tests passed
• isolated tarball install, --help, and --version
• packed CLI ↔ local Worker small-file and multipart journeys
• production npm audit: 0 vulnerabilities for Worker and CLI
• independently rebuilt tarball matched byte-for-byte
• candidate artifact SHA-256: 82cb3dc3c1dcd9dae34b115663f7ea5b03f91998e047fc5f5db817f6dcd9c52e

Release boundary

This PR does not create v0.1.0, publish a GitHub Release, deploy the Worker, or publish to npm. Those remain separately authorized steps after required CI passes on Node 20 and 22.

[Copilot]

Pull request overview

This PR prepares Conduit for an initial npm release by hardening the CLI ↔ Worker API contract, tightening credential / endpoint safety, and adding deterministic “test the exact tarball” release gating in CI and publish workflows.

Changes:

• Add an explicit API version contract between Worker admin API and CLI, and enforce it in the client.
• Harden CLI network/security behaviors (endpoint normalization, redirect handling, safer secret input, stricter destructive resolution) and extend CLI tests.
• Introduce a deterministic release gate (tarball build/install/e2e journey) and wire it into CI and publish workflows with pinned GitHub Actions.

Reviewed changes

Copilot reviewed 30 out of 31 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
vitest.config.ts	Allows Worker tests to select a temporary Wrangler config via env var (release gate hermetic config).
test/admin.test.ts	Verifies whoami includes API version and version header.
test/access.test.ts	Adds unit tests for Access team-origin normalization and rejection cases.
src/routes/admin.ts	Adds API version header middleware and exposes api_version in whoami.
src/lib/api-version.ts	Defines Worker admin API version constant.
src/lib/access.ts	Hardens Access team origin parsing/validation (canonical HTTPS only).
README.md	Clarifies Worker↔CLI version coupling and updates deploy instructions.
package.json	Adds release:check script entry for deterministic release gate.
cli/test/util.test.ts	Extends duration parsing tests (range and invalid inputs).
cli/test/push.test.ts	Adds tests for upload error exit-code classification.
cli/test/client.test.ts	Adds tests for destructive-safe resolveFile behavior.
cli/test/api.test.ts	Adds endpoint/redirect/API-version/immutability tests for CLI client.
cli/src/version.ts	Loads CLI version from cli/package.json at runtime (source and packed artifact).
cli/src/util.ts	Adds max TTL bound for durations and validates parsed durations.
cli/src/index.ts	Switches CLI version source + adds safer login secret input option and rm --json.
cli/src/commands/rm.ts	Disables ID-prefix resolution for destructive rm; adds JSON output; improves auth exit code.
cli/src/commands/push.ts	Adds shared upload error exit classifier; adjusts upload typing and error handling.
cli/src/commands/login.ts	Supports reading Access client secret from stdin instead of CLI args.
cli/src/commands/link.ts	Improves auth-related exit codes.
cli/src/client.ts	Adds option to disallow ID-prefix resolution for destructive commands.
cli/src/api.ts	Adds endpoint normalization, redirect hardening, API version enforcement, response validation, and upload immutability checks.
cli/README.md	Clarifies that CLI requires a compatible self-hosted Worker + updates Node requirement and login docs.
cli/package.json	Tightens Node engine, switches to prepack, adjusts bin path, and pins commander to Node 20-compatible version.
cli/package-lock.json	Updates lockfile for commander downgrade and Node engine requirement.
cli/LICENSE	Adds CLI LICENSE file (expected by tarball and release gate checks).
.github/workflows/publish.yml	Publishes only the tested tarball; runs deterministic release gate; pins actions by SHA.
.github/workflows/ci.yml	Pins actions by SHA; adds artifact pack/install smoke test and a release-gate job.
.agents/skills/conduit-release-gate/SKILL.md	Adds repository skill documentation for release gating expectations.
.agents/skills/conduit-release-gate/scripts/run-release-gate.mjs	Implements deterministic release checks: typecheck/tests/build/pack/install/e2e and supply-chain assertions.
.agents/skills/conduit-release-gate/references/release-criteria.md	Documents required evidence, blockers, and verdict format for releases.
.agents/skills/conduit-release-gate/agents/openai.yaml	Registers the release gate skill metadata for the agent UI.

Files not reviewed (1)

• cli/package-lock.json: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 30 out of 31 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• cli/package-lock.json: Generated file

Comments suppressed due to low confidence (1)

cli/src/api.ts:94

• new URL('http://[::1]:8787').hostname is ::1 (without brackets), so the current loopback check will reject IPv6 loopback even though tests expect it to be allowed.

function isLoopback(hostname: string): boolean {
  return (
    hostname === 'localhost' ||
    hostname.endsWith('.localhost') ||
    hostname === '127.0.0.1' ||
    hostname === '[::1]'
  );