chore: remove npm-mirror leftovers after align 9.0.0 #2

jercik · 2026-10-22T17:20:55Z

jercik commented

2026-10-22 17:20:55 +00:00

Removes the npm-mirror leftovers after align 9.0.0, since the package no longer publishes to npmjs.

release.yml loses 465 lines (10 added): the npm-mirror job, its integrity step and the npmjs OIDC gating. It still publishes @j4k-oss/askpplx to the Forge registry. The GitHub release-npm.yml workflow and the .npm-mirror marker are deleted, and align refreshed the files it manages (AGENTS.md, two check-dts scripts, a workflow comment).

The README now installs and runs @j4k-oss/askpplx with --@j4k-oss:registry=https://code.j4k.dev/api/packages/j4k-oss/npm/, because the @j4k-oss scope on npmjs has an unconfirmed owner. The unscoped askpplx is frozen at its last version.

🤖 Generated with Claude Code

Removes the npm-mirror leftovers after align 9.0.0, since the package no longer publishes to npmjs. `release.yml` loses 465 lines (10 added): the `npm-mirror` job, its integrity step and the npmjs OIDC gating. It still publishes `@j4k-oss/askpplx` to the Forge registry. The GitHub `release-npm.yml` workflow and the `.npm-mirror` marker are deleted, and align refreshed the files it manages (`AGENTS.md`, two `check-dts` scripts, a workflow comment). The README now installs and runs `@j4k-oss/askpplx` with `--@j4k-oss:registry=https://code.j4k.dev/api/packages/j4k-oss/npm/`, because the `@j4k-oss` scope on npmjs has an unconfirmed owner. The unscoped `askpplx` is frozen at its last version. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jercik added 2 commits

2026-10-22 17:20:55 +00:00

chore: remove npm-mirror leftovers after align 9.0.0 0f2998b7ee

Drops the npm-mirror job, its integrity step and the npmjs OIDC gating
from the Forgejo release workflow, deletes the GitHub release-npm
workflow and the .npm-mirror marker, and syncs the files align 9.0.0
renders.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs: point install instructions at the scoped Forge package

Checks / pr-flow-canary (pull_request) Has been skipped

Details

Checks / reuse (pull_request) Successful in 5s

Details

commit-msg / commitlint (pull_request) Successful in 15s

Details

Checks / quality-checks (26.5.0) (pull_request) Successful in 34s

Details

Checks / quality-checks (24.15.0) (pull_request) Successful in 35s

Details

Review / Review (pull_request_target) Successful in 4m13s

Details

f3c42f012d

Install and run commands now use @j4k-oss/askpplx with the scope's
registry flag, and the examples run the installed askpplx command. The
unscoped npm package is frozen at its last version.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

forgejo-actions commented

2026-10-22 17:25:08 +00:00

Review 01M5JB35CPX68KNP17XM903HBQ — head c8cdc249d7cf2eb581b3244941e113a37a21894e

Review — j4k-oss/askpplx @ `ad954a979a`

Scope: diff against base tree 1bac5930d248
Status: dispatched — coverage complete (5/5 slots terminal)
Facts: current review-wide projection

Computed under:

{
  "abandonment": "abandonment-v1",
  "anchor_recipe": 1,
  "batch_policy": "batch-v1",
  "coverage": "coverage-v3",
  "dispatch_policy": "dispatch-v2",
  "grounder_version": 1,
  "grounding_read_rule": "grounding-read-v1",
  "promotion_policy": "promotion-v1",
  "report": "report-v4",
  "tally": "tally-v1",
  "triage_settle": "triage-settle-v2"
}

Findings (1)

low — The agent rule overstates what `--help` verifies

claim: 01M5JB9YZH19YGN43TNH0MS427
anchor: README.md (snippet)

At the start of each session, run `askpplx --help` to verify the CLI is available and configured properly and check available options.

lens: writing-quality · arm: default
verdicts: 1 valid / 0 invalid / 0 uncertain
- pass 01M5JBCB772S9ZBC9R1CNNMSPK · valid: The exact-grounded README sentence says askpplx --help verifies that the CLI is configured properly. The reviewer reports a specific static trace: src/cli.ts calls formatRequiresHelpText(getPerplexityApiKey()); src/config.ts retrieves an environment or stored string without authentication; src/format-requires-help-text.ts labels any nonempty string configured and shows its suffix; API requests occur on the separate src/run-cli.ts query path. Those implementation details are reviewer-supplied evidence, not independently grounded source, but coherently establish that an invalid nonempty key can satisfy this check. The instruction therefore gives an agent a false assurance of readiness. I reassessed the matching historical allegation and its valid rationale; it supplies no concrete refutation, and there is no owner closure or conflicting evidence. Low severity is appropriate. Narrowing the sentence to availability, options, and key presence preserves its operational instruction and corrects the assurance. The CLI standard does not require adding authentication to help.
disposition: none

An agent following this rule can treat an expired or invalid API key as a working configuration and proceed on a false assumption about CLI readiness. Help output confirms that a key is present, not that Perplexity accepts it.

In src/cli.ts, the help callback calls formatRequiresHelpText(getPerplexityApiKey()). getPerplexityApiKey in src/config.ts returns the environment value or stored string without authentication. formatRequiresHelpText in src/format-requires-help-text.ts labels any nonempty string as configured and displays its last four characters. The API call belongs to the separate runCli query path in src/run-cli.ts.

Replace the anchored sentence with: "At the start of each session, run askpplx --help to check availability, inspect options, and see whether an API key is set." This preserves the startup instruction and its useful configuration-presence check without adding an authentication probe or a second inventory of CLI options. It follows writing-for-agents' Use Precise Language guidance: completion evidence must establish the claim made about it.

I traced the help callback, configuration lookup, formatter, and query path, and read src/format-requires-help-text.test.ts, whose configured-key example checks only the suffix display. This is static source evidence; I did not execute a query or verify a real credential. An authentication request on the actual help path would refute the claim; none appears in the traced path.

Other claims

grounding-pending (0)
ungrounded (0)
rejected (0)
duplicate-of (0)
unadjudicated (1)
- 01M5JBB609TPWGW1F57KSYAMCA medium — The repoq rule independently counts the tool's write commands

Coverage

Coverage pass: 01M5JB3NQBTE10XMRM4VT1706R
Accounting: complete
Slot health: healthy

lens	part	arm	unit status	runs	loss
restated-sets	whole	default	claims-emitted	1	no
general-bug	ci-workflows	default	no-claims	1	no
general-bug	scripts	default	no-claims	1	no
project-docs	whole	default	no-claims	1	no
writing-quality	docs	default	claims-emitted	1	no

test-trimming — skipped-by-dispatch: no test files changed
unix-cli — skipped-by-dispatch: changes are CI workflows, docs and small script edits, not CLI behavior
use-effect — skipped-by-dispatch: no React code or Effects in changed paths
react — skipped-by-dispatch: no React components or related files in changed paths

**Review** `01M5JB35CPX68KNP17XM903HBQ` — head `c8cdc249d7cf2eb581b3244941e113a37a21894e` # Review — j4k-oss/askpplx @ ad954a979a18 Scope: diff against base tree `1bac5930d248` Status: dispatched — coverage complete (5/5 slots terminal) Facts: current review-wide projection Computed under: ```json { "abandonment": "abandonment-v1", "anchor_recipe": 1, "batch_policy": "batch-v1", "coverage": "coverage-v3", "dispatch_policy": "dispatch-v2", "grounder_version": 1, "grounding_read_rule": "grounding-read-v1", "promotion_policy": "promotion-v1", "report": "report-v4", "tally": "tally-v1", "triage_settle": "triage-settle-v2" } ``` ## Findings (1) ### low — The agent rule overstates what `--help` verifies - claim: `01M5JB9YZH19YGN43TNH0MS427` - anchor: `README.md` (snippet) ``` At the start of each session, run `askpplx --help` to verify the CLI is available and configured properly and check available options. ``` - lens: writing-quality · arm: default - verdicts: 1 valid / 0 invalid / 0 uncertain - pass `01M5JBCB772S9ZBC9R1CNNMSPK` · valid: The exact-grounded README sentence says askpplx --help verifies that the CLI is configured properly. The reviewer reports a specific static trace: src/cli.ts calls formatRequiresHelpText(getPerplexityApiKey()); src/config.ts retrieves an environment or stored string without authentication; src/format-requires-help-text.ts labels any nonempty string configured and shows its suffix; API requests occur on the separate src/run-cli.ts query path. Those implementation details are reviewer-supplied evidence, not independently grounded source, but coherently establish that an invalid nonempty key can satisfy this check. The instruction therefore gives an agent a false assurance of readiness. I reassessed the matching historical allegation and its valid rationale; it supplies no concrete refutation, and there is no owner closure or conflicting evidence. Low severity is appropriate. Narrowing the sentence to availability, options, and key presence preserves its operational instruction and corrects the assurance. The CLI standard does not require adding authentication to help. - disposition: none > An agent following this rule can treat an expired or invalid API key as a working configuration and proceed on a false assumption about CLI readiness. Help output confirms that a key is present, not that Perplexity accepts it. > > In `src/cli.ts`, the help callback calls `formatRequiresHelpText(getPerplexityApiKey())`. `getPerplexityApiKey` in `src/config.ts` returns the environment value or stored string without authentication. `formatRequiresHelpText` in `src/format-requires-help-text.ts` labels any nonempty string as configured and displays its last four characters. The API call belongs to the separate `runCli` query path in `src/run-cli.ts`. > > Replace the anchored sentence with: "At the start of each session, run `askpplx --help` to check availability, inspect options, and see whether an API key is set." This preserves the startup instruction and its useful configuration-presence check without adding an authentication probe or a second inventory of CLI options. It follows writing-for-agents' Use Precise Language guidance: completion evidence must establish the claim made about it. > > I traced the help callback, configuration lookup, formatter, and query path, and read `src/format-requires-help-text.test.ts`, whose configured-key example checks only the suffix display. This is static source evidence; I did not execute a query or verify a real credential. An authentication request on the actual help path would refute the claim; none appears in the traced path. ## Other claims - grounding-pending (0) - ungrounded (0) - rejected (0) - duplicate-of (0) - unadjudicated (1) - `01M5JBB609TPWGW1F57KSYAMCA` medium — The repoq rule independently counts the tool's write commands ## Coverage Coverage pass: 01M5JB3NQBTE10XMRM4VT1706R Accounting: complete Slot health: healthy | lens | part | arm | unit status | runs | loss | | --- | --- | --- | --- | --- | --- | | restated-sets | whole | default | claims-emitted | 1 | no | | general-bug | ci-workflows | default | no-claims | 1 | no | | general-bug | scripts | default | no-claims | 1 | no | | project-docs | whole | default | no-claims | 1 | no | | writing-quality | docs | default | claims-emitted | 1 | no | - test-trimming — skipped-by-dispatch: no test files changed - unix-cli — skipped-by-dispatch: changes are CI workflows, docs and small script edits, not CLI behavior - use-effect — skipped-by-dispatch: no React code or Effects in changed paths - react — skipped-by-dispatch: no React components or related files in changed paths

🚀 1

forgejo-actions reviewed

2026-10-22 17:25:08 +00:00

README.md

					
				@ -72,3 +85,3 @@

				# Rule: Use `askpplx` for Current Facts

				At the start of each session, run `npx -y askpplx --help` to verify the CLI is available and configured properly and check available options.

				At the start of each session, run `askpplx --help` to verify the CLI is available and configured properly and check available options.

low — The agent rule overstates what askpplx --help verifies

An agent following this rule can treat a mistyped or revoked API key as verified configuration and discover the authentication failure only when it needs an answer. The help command shows key presence, not whether Perplexity accepts the key.

In src/cli.ts, the help preamble calls formatRequiresHelpText(getPerplexityApiKey()). src/config.ts returns the environment or stored string without authenticating it; src/format-requires-help-text.ts labels any nonempty string as configured and displays its last four characters. The request path is separate, through runCli in src/run-cli.ts.

Replace the sentence with: “At the start of each session, run askpplx --help to check CLI availability, available options, and whether an API key is present.” This preserves the startup check and its useful configuration signal without promising credential validation or adding a network request. It follows writing-for-agents’ “Use Precise Language” guidance and the human-facing guide’s rule against widening a claim beyond its evidence.

I traced those functions and read src/format-requires-help-text.test.ts, which tests missing-key text and the suffix display. This is a static finding; I did not make an API request. A help-time authentication check would refute it, but the inspected help path contains none.

lens writing-quality · arm default · tally 1 valid / 0 invalid / 0 uncertain
claim 01M5JA6T84HS6J4EMEZT6R6646 of review 01M5JA2X5MVPTWF9ZSCHH0Z4Z8

**low** — The agent rule overstates what `askpplx --help` verifies > An agent following this rule can treat a mistyped or revoked API key as verified configuration and discover the authentication failure only when it needs an answer. The help command shows key presence, not whether Perplexity accepts the key. > > In src/cli.ts, the help preamble calls formatRequiresHelpText(getPerplexityApiKey()). src/config.ts returns the environment or stored string without authenticating it; src/format-requires-help-text.ts labels any nonempty string as configured and displays its last four characters. The request path is separate, through runCli in src/run-cli.ts. > > Replace the sentence with: “At the start of each session, run `askpplx --help` to check CLI availability, available options, and whether an API key is present.” This preserves the startup check and its useful configuration signal without promising credential validation or adding a network request. It follows writing-for-agents’ “Use Precise Language” guidance and the human-facing guide’s rule against widening a claim beyond its evidence. > > I traced those functions and read src/format-requires-help-text.test.ts, which tests missing-key text and the suffix display. This is a static finding; I did not make an API request. A help-time authentication check would refute it, but the inspected help path contains none. lens `writing-quality` · arm `default` · tally 1 valid / 0 invalid / 0 uncertain claim `01M5JA6T84HS6J4EMEZT6R6646` of review `01M5JA2X5MVPTWF9ZSCHH0Z4Z8`

🚀 1

jercik marked this conversation as resolved

jercik referenced this pull request

2026-10-22 17:33:45 +00:00

docs: say what askpplx --help actually checks #3

jercik commented

2026-10-22 17:36:11 +00:00

Replying to review comment #177968

Tracked in #3. The finding holds: askpplx --help prints the key as configured (last four characters) without any network call. With a bogus key it still printed configured, and only a real request failed with Invalid API key provided. The sentence predates this PR, which only changes the command in it. #3 rewrites it to claim only CLI availability, options and key presence. It edits the same line as this PR, so I will merge this PR first and then update #3.

> Replying to review comment #177968 Tracked in https://code.j4k.dev/j4k-oss/askpplx/pulls/3. The finding holds: `askpplx --help` prints the key as configured (last four characters) without any network call. With a bogus key it still printed `configured`, and only a real request failed with `Invalid API key provided`. The sentence predates this PR, which only changes the command in it. #3 rewrites it to claim only CLI availability, options and key presence. It edits the same line as this PR, so I will merge this PR first and then update #3.

jercik added 1 commit

2026-10-22 17:38:38 +00:00

docs: tell existing global installs to uninstall first and keep the registry line

Checks / pr-flow-canary (pull_request) Has been skipped

Details

Checks / reuse (pull_request) Successful in 4s

Details

commit-msg / commitlint (pull_request) Successful in 13s

Details

Checks / quality-checks (24.15.0) (pull_request) Successful in 42s

Details

Checks / quality-checks (26.5.0) (pull_request) Successful in 46s

Details

Review / Review (pull_request_target) Successful in 6m26s

Details

c8cdc249d7

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

forgejo-actions reviewed

2026-10-22 17:45:02 +00:00

README.md

					
				@ -72,3 +87,3 @@

				# Rule: Use `askpplx` for Current Facts

				At the start of each session, run `npx -y askpplx --help` to verify the CLI is available and configured properly and check available options.

				At the start of each session, run `askpplx --help` to verify the CLI is available and configured properly and check available options.

low — The agent rule overstates what --help verifies

An agent following this rule can treat an expired or invalid API key as a working configuration and proceed on a false assumption about CLI readiness. Help output confirms that a key is present, not that Perplexity accepts it.

In src/cli.ts, the help callback calls formatRequiresHelpText(getPerplexityApiKey()). getPerplexityApiKey in src/config.ts returns the environment value or stored string without authentication. formatRequiresHelpText in src/format-requires-help-text.ts labels any nonempty string as configured and displays its last four characters. The API call belongs to the separate runCli query path in src/run-cli.ts.

Replace the anchored sentence with: "At the start of each session, run askpplx --help to check availability, inspect options, and see whether an API key is set." This preserves the startup instruction and its useful configuration-presence check without adding an authentication probe or a second inventory of CLI options. It follows writing-for-agents' Use Precise Language guidance: completion evidence must establish the claim made about it.

I traced the help callback, configuration lookup, formatter, and query path, and read src/format-requires-help-text.test.ts, whose configured-key example checks only the suffix display. This is static source evidence; I did not execute a query or verify a real credential. An authentication request on the actual help path would refute the claim; none appears in the traced path.

lens writing-quality · arm default · tally 1 valid / 0 invalid / 0 uncertain
claim 01M5JB9YZH19YGN43TNH0MS427 of review 01M5JB35CPX68KNP17XM903HBQ

**low** — The agent rule overstates what `--help` verifies > An agent following this rule can treat an expired or invalid API key as a working configuration and proceed on a false assumption about CLI readiness. Help output confirms that a key is present, not that Perplexity accepts it. > > In `src/cli.ts`, the help callback calls `formatRequiresHelpText(getPerplexityApiKey())`. `getPerplexityApiKey` in `src/config.ts` returns the environment value or stored string without authentication. `formatRequiresHelpText` in `src/format-requires-help-text.ts` labels any nonempty string as configured and displays its last four characters. The API call belongs to the separate `runCli` query path in `src/run-cli.ts`. > > Replace the anchored sentence with: "At the start of each session, run `askpplx --help` to check availability, inspect options, and see whether an API key is set." This preserves the startup instruction and its useful configuration-presence check without adding an authentication probe or a second inventory of CLI options. It follows writing-for-agents' Use Precise Language guidance: completion evidence must establish the claim made about it. > > I traced the help callback, configuration lookup, formatter, and query path, and read `src/format-requires-help-text.test.ts`, whose configured-key example checks only the suffix display. This is static source evidence; I did not execute a query or verify a real credential. An authentication request on the actual help path would refute the claim; none appears in the traced path. lens `writing-quality` · arm `default` · tally 1 valid / 0 invalid / 0 uncertain claim `01M5JB9YZH19YGN43TNH0MS427` of review `01M5JB35CPX68KNP17XM903HBQ`

🚀 1

jercik marked this conversation as resolved

jercik commented

2026-10-22 17:48:03 +00:00

Replying to review 01M5JB35CPX68KNP17XM903HBQ (summary #177966, head c8cdc249)

Agent rule overstating --help (claim 01M5JB9YZH19YGN43TNH0MS427, inline #178085): valid and predates this PR. Tracked in #3.
Unadjudicated claim 01M5JBB609TPWGW1F57KSYAMCA (the repoq guidance counts the tool's write commands): not a defect in this PR. The sentence "It also carries one write verb: pr create" is in the generated AGENTS.md/CLAUDE.md, which align regenerated here from the shared rule repoq/repoq-usage.md; generated files are not edited by hand. The count is accurate today: repoq registers pr create as its only write command (src/cli/register-pr-command.ts). If repoq gains another write verb, the shared rule in the align repository needs the update, which is outside these PRs.

> Replying to review `01M5JB35CPX68KNP17XM903HBQ` (summary #177966, head c8cdc249) - Agent rule overstating `--help` (claim `01M5JB9YZH19YGN43TNH0MS427`, inline #178085): valid and predates this PR. Tracked in https://code.j4k.dev/j4k-oss/askpplx/pulls/3. - Unadjudicated claim `01M5JBB609TPWGW1F57KSYAMCA` (the repoq guidance counts the tool's write commands): not a defect in this PR. The sentence "It also carries one write verb: `pr create`" is in the generated `AGENTS.md`/`CLAUDE.md`, which align regenerated here from the shared rule `repoq/repoq-usage.md`; generated files are not edited by hand. The count is accurate today: repoq registers `pr create` as its only write command (`src/cli/register-pr-command.ts`). If repoq gains another write verb, the shared rule in the align repository needs the update, which is outside these PRs.

jercik commented

2026-10-22 17:48:07 +00:00

Replying to review comment #178085

Tracked in #3, the same finding as #177968. The sentence predates this PR; #3 rewrites it to say that askpplx --help checks availability, options and whether an API key is present. #3 has a one-line conflict with this PR, which I resolve there after this PR lands.

> Replying to review comment #178085 Tracked in https://code.j4k.dev/j4k-oss/askpplx/pulls/3, the same finding as #177968. The sentence predates this PR; #3 rewrites it to say that `askpplx --help` checks availability, options and whether an API key is present. #3 has a one-line conflict with this PR, which I resolve there after this PR lands.

jercik merged commit 62f769f163 into main

2026-10-22 17:49:48 +00:00

jercik deleted branch chore/remove-npm-mirror

2026-10-22 17:49:48 +00:00

jercik referenced this pull request from a commit

2026-10-22 17:49:49 +00:00

chore: remove npm-mirror leftovers after align 9.0.0 (#2)

Sign in to join this conversation.

No reviewers

No labels

No milestone

No assignees

2 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

j4k-oss/askpplx!2

Rows
Columns

chore: remove npm-mirror leftovers after align 9.0.0 #2

Review — j4k-oss/askpplx @ ad954a979a

Findings (1)

low — The agent rule overstates what --help verifies

Other claims

Coverage

Review — j4k-oss/askpplx @ `ad954a979a`

low — The agent rule overstates what `--help` verifies