scripts/setup-npm-registry.mjs configures npm to pull @redsentech
packages (e.g. @redsentech/lean-harness) from GitHub Packages:
- Discovers a token: --token flag > env (NPM_REGISTRY_TOKEN/
GITHUB_TOKEN/GH_TOKEN) > `gh auth token` > interactive masked prompt
(raw-mode stdin, no echo, no external deps).
- Verifies the token against the GitHub API, reports the authenticated
login, and warns if the OAuth scopes are missing read:packages/
write:packages.
- Writes/updates only its own two lines in .npmrc (scope registry +
auth token), preserving every other line; idempotent on rerun.
- Never prints the full token (masked in all output).
- --dry-run, --unset (clean removal), --local, --scope, --registry,
--skip-verify, --npmrc <path> flags.
- Confirms the result with `npm whoami --registry ...`.
Verified live end-to-end: real GitHub PAT via `gh auth token` ->
verified against api.github.com -> written to a scratch .npmrc ->
`npm whoami` succeeded. Also confirmed the scope-warning is accurate:
installing @redsentech/lean-harness with a token lacking read:packages
correctly 403s, exactly as the script warns it will.
Adds tests/setup-npm-registry.test.mjs (7 hermetic tests: dry-run,
write+preserve, token never printed, idempotent rerun, --unset,
custom scope/registry, clean failure with no token). Adds
"setup-npm-registry" npm script. Documents the script in README (The
`lh` CLI section) and docs/QUICKSTART.md (install + troubleshooting).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
\`node --test tests/\` throws MODULE_NOT_FOUND on this Node CLI (it
resolves the bare directory as a CommonJS entry module instead of a
test-runner glob) — this was masked locally all session because every
manual verification used \`node --test tests/*.test.mjs\` directly,
never the actual \`npm test\` script. CI caught it on the first real
run. Fixed package.json's test script to use the explicit glob.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- scripts/onboard.mjs: bootstraps a target repo onto the harness — copies
the behaviour layer (.github/agents, skills, instructions, prompts,
mcp.json, copilot-instructions.md, AGENTS.md), npm links the `lh` CLI,
runs `lh init` + `lh doctor`, prints next steps. Idempotent: identical
files are skipped, differing files require --force, re-running `lh init`
on an initialized repo warns instead of failing. Supports --dry-run and
--no-npm-link for CI/sandboxed use.
- tests/onboard.test.mjs: 5 new e2e tests (dry-run, full run, idempotent
rerun, missing target dir, conflict + --force).
- README: new "Onboarding a new project" section, full lh flag reference
for every subcommand (previously only one-line summaries), Development
section mentions the onboarding script.
Live-tested against ~/Sources/ralph-runtime (a real, not-yet-git-tracked
project): git init, .github/ copied, `npm link` succeeded, `lh init`
ran, `lh doctor` correctly flagged its one real gap (no verify command
configured) rather than a false pass.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Recovered from crashed session (Node OOM). Repo contains full P0-P6
scaffold: plugin.json/marketplace.json, AGENTS.md, ADRs 0001-0006,
lh CLI (init/index/graph/lane/run/memory/host/report/doctor), 10
.github/agents, 12 CLI skills, instructions, context7 mcp.json, and
unit/e2e test suite.
Fixed: run.mjs read --in-tokens/--out-tokens but tests and CLI docs
use --input-tokens/--output-tokens, so telemetry totals were always 0.
Now accepts both forms.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
mozempkandCopilot