fix(cli): exit 0 from --help and --version; repair the post-publish check (0.5.1)

[qmarcelle]

Summary

@workspacejson/cli@0.5.0 published successfully — signed provenance, SLSA attestation, installs and runs. The release run still went red at the final step, and chasing that turned up two real defects and one false claim of mine.

1. --help and --version exited 1

The CLI uses commander's .exitOverride(), which throws instead of exiting — including on its success paths, where both raise a CommanderError carrying exitCode: 0. The handler read it as:

Number(error.exitCode) || 1     // 0 || 1 === 1

The output was always correct; only the status was wrong — so both commands reported failure to every shell, script and CI job that checked them.

Inherited from agents-audit, where the same expression sits. That package is frozen at 0.4.4, so its --help keeps the old exit code permanently.

Regression tests cover --help, --version, the version subcommand, and a guard that an unknown option still exits non-zero. Watched red against the pre-fix source — 2 failed with expected 1 to be +0, exactly the two success paths, while the guards passed both ways.

2. The post-publish check could never pass

It ran <bin> --help, so defect 1 guaranteed a non-zero result regardless of how healthy the release was.

I previously reported this verifier as passing end-to-end for agents-audit, including in #14's checklist. It did not pass. I read ${PIPESTATUS[0]} after piping through tail — which reports tail's status, not the script's — and took the visible help output as success without confirming the Verified registry install... line. The check has never passed for either package.

It now runs version: a normal action returning 0, and a stronger check besides — it executes the installed entry point and prints the version the artifact actually carries, rather than text commander emits before any package code runs. Confirmed exit 0 against the live 0.5.0.

3. The propagation window was too short

Measured on the 0.5.0 release: the version endpoint answered immediately, but the aggregated packument — what npm install resolves against — took ~4m30s:

02:26:44  packument=404
02:27:14  packument=404
02:27:45  packument=200

The old window summed to 75s, so it failed a release that had published correctly. Now linear backoff with a 60s ceiling, ~6m30s total. A first-ever publish is the slow case: there is no existing packument to update.

Release

Cut as 0.5.1 through the changeset flow — its first real exercise. Changeset added, pnpm changeset version bumped the manifest and wrote the changelog in one step. Also dated 0.5.0, still labelled Unreleased.

Verification

• pnpm run check:architecture
• pnpm -r typecheck
• pnpm -r build
• pnpm -r test — 108 tests (64 + 44), including 4 new
• Regression tests confirmed red against pre-fix source
• pnpm run release:verify-packs — workspacejson-cli-0.5.1.tgz, agents-audit-0.4.4.tgz
• verify-published.mjs @workspacejson/cli — exit 0 against the live 0.5.0, the first time this check has ever passed
• bash migration/parity-agents-audit-runtime.sh — not run locally; CI runs it unconditionally. No agents-audit runtime code changed.

Notes

Release after merge: git tag cli-v0.5.1 && git push --tags.

0.5.0 stays published and working — this is a follow-up patch, not a repair of a broken release. Users on 0.5.0 get correct behaviour from everything except the --help/--version exit status.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.