saberzero1/motions 1.1.1

on GitHub

Changed

• Both CodeMirror forks are now consumed from the npm registry instead of git URLs — npm 12 blocks a dependency's install scripts unless the root package's allowScripts policy covers them, and prepare counts as an install script for non-registry sources. A git dependency cannot be approved: an allowScripts entry for it, pinned (@saberzero1/codemirror-vim@6.3.0) or name-only, is still reported as uncovered, while a registry package with a postinstall (esbuild@0.28.1) approves normally. Both forks build their dist/ in prepare and commit no build output, so under npm 12 they installed as LICENSE, package.json and README.md alone — measured with the community scanner's own analysis command, npm ci --allow-git=all --allow-remote=all --ignore-scripts, which left no dist/index.js and no dist/index.d.ts, breaking npm run build and typecheck together. Publishing to a scope we own and consuming through npm: aliases sidesteps the policy, because registry dependencies are exempt from it even when the published package still declares prepare — upstream @codemirror/autocomplete does, and installs clean under --strict-allow-scripts. The aliases preserve the original import specifiers, so no source file and neither overrides block changed, and the published output is byte-identical to what a git install built across all four files of both packages. The lockfile now carries no git or otherwise non-registry resolved entry at all, so the plugin also installs under npm 12's bare defaults, where allow-git and allow-remote both default to "none", and no longer depends on any scanner escape hatch.
  • Plugin: package.json (@replit/codemirror-vim → npm:@saberzero1/codemirror-vim@^6.3.0, @codemirror/autocomplete → npm:@saberzero1/codemirror-autocomplete@^6.20.3), package-lock.json
  • Fork: ~/Repos/codemirror-vim — published as @saberzero1/codemirror-vim, with a new .github/workflows/publish.yml that publishes over OIDC trusted publishing with no token and is gated on the version being absent from the registry. The publish script is renamed to release, because publish is a real npm lifecycle hook that runs after upload and would have re-entered npm publish on every success. .gitignore now un-ignores .github: its blanket .* rule matched the new workflow, so git add skipped it silently, and the existing workflows survive only because they predate that rule. The workflow publishes with --ignore-scripts and sets an empty NODE_AUTH_TOKEN for its install step, because actions/setup-node's registry-url writes an .npmrc containing a literal ${NODE_AUTH_TOKEN} that npm ignores but yarn 1 aborts on, and this fork's prepare shells out to yarn.
  • Fork: ~/Repos/autocomplete — published as @saberzero1/codemirror-autocomplete, with the same publish workflow. A files allowlist now drops .direnv, flake.nix, flake.lock and .envrc from the tarball, which .npmignore never excluded: 14 files and 89.2 kB down to 9 files and 70.0 kB.

Fixed

• The Windows CI Neovim installer no longer rejects a perfectly good Neovim — the API-floor check failed intermittently with a message that refutes itself, Neovim API level 14 … is below required level 12. The level was never the problem; the captured string was. Both installers read the probe's output with 2>&1, and headless Neovim writes every message to stderr — msg_puts_printf in src/nvim/message.c ends at fprintf(stderr, …) for everything except the info_message branch that --version and --help take — so any warning was concatenated into the value that ^\d+$ then rejected. The warning was Neovim's own: .github/workflows/e2e.yml sets NVIM_LOG_FILE: /tmp/nvim-debug.log for every job, Windows Neovim cannot create that path, so log_path_init falls back and exports __NVIM_LOG_FILE_WANT, and on VimEnter runtime/lua/vim/_core/log.lua:check_log_file reports log: "…" not accessible, logging to: "…". Linux and macOS can write /tmp/nvim-debug.log and never produced it. The intermittency is a 100 ms race and nothing else: check_log_file notifies through vim.defer_fn(…, 100), while the probe is -c 'lua io.write(vim.version().api_level)' -c 'qa' and normally exits well before that timer fires, so only a slow enough runner saw the warning at all. Both installers now capture stdout alone, where nothing but the io.write lands; the warning still reaches the job log, where it is worth reading. Forced against the official 0.12.5 release tarball with NVIM_LOG_FILE pointed at a directory and the quit deferred past the timer — stdout 14, stderr the warning — the old capture throws in real pwsh and the new one reports 14. A three-attempt retry was considered and rejected: the run that loses the race fails deterministically, so retrying turns one failure into three and would additionally hide a real API-floor violation. Dropping the merge also emptied the PowerShell throw in the case where Neovim writes nothing at all, so it now reports unknown, matching the shell script
  • Scripts: scripts/install-neovim.ps1, scripts/install-neovim.sh

Documentation

• AGENTS.md: replaced the git-URL dependency mandate with the registry-alias rule, including why a git dependency cannot be allow-listed and the note that npm install will not re-resolve a spec changed from git to an alias; added a fork-publishing section covering the trusted-publisher filename coupling and the yarn/.npmrc interaction
• CHANGELOG.md
• docs/development/index.md: rewrote the dependency-URL warning as a dependency-spec warning and added a "Shipping a fork change" callout
• test/flaky-inventory.md: recorded the root cause, the forced failure and the fix probe, plus the still-open Windows NVIM_LOG_FILE diagnostics gap the same investigation surfaced

Full Changelog: 1.1.0...1.1.1