Skip to content

v0.1.0-rc.3 — Generative UI Protocol

Pre-release
Pre-release

Choose a tag to compare

View all tags
@wanseob wanseob released this 24 May 07:42
v0.1.0-rc.3
558aae1

v0.1.0-rc.3 — pnpm-OIDC root cause fix + multi-provider work

Third public release candidate of the @ggui-ai/* npm wave. Install via npm install @ggui-ai/cli@next (next dist-tag for prereleases; latest stays on whatever stable is current, which is still nothing — 0.1.0 GA pending).

Why rc.3 (and not just rc.2)

Update (this draft): The first rc.3 attempt also 404'd. Root cause was DEEPER than the registry-url fix: pnpm 9 does not natively engage OIDC publishing. Upgraded to pnpm 11.2.2 + migrated all pnpm config (overrides, settings) from package.json/.npmrc to pnpm-workspace.yaml per pnpm 11 layout. This draft cut against the fresh workflow.

rc.2 was cut, draft was flipped to published, the workflow ran the OIDC publish step — and every attempt 404'd at the first package's tarball PUT. Six hours of investigation traced the root cause to a real pnpm bug: when actions/setup-node writes _authToken=${NODE_AUTH_TOKEN} to .npmrc and NODE_AUTH_TOKEN is unset (the normal state under OIDC Trusted Publishing), pnpm 9.x passes the literal ${NODE_AUTH_TOKEN} placeholder through verbatim — registry returns 404 (npm's masked auth-failure response) BEFORE OIDC fallback fires. Documented in pnpm/pnpm#11513, fixed in pnpm 11.0.9+ via pnpm/pnpm#11526; not backported to 9.x. The surgical workaround that landed in this rc: drop registry-url: from the publish job's setup-node config so the broken .npmrc never gets written. rc.2 release+tag deleted, version available again, rc.3 picks up where rc.2 should have shipped.

Reliability + tooling improvements since v0.1.0-rc.1

  • Pre-cut publish-gate as a slash-command step — /release:cut now fires publish-gate.yml via workflow_dispatch BEFORE creating the GitHub draft. If the gate is red, no draft is ever cut. Two-layer defense in depth with the on-flip gate already wired into release.yml. Caught 3 release-time parity-drift bugs during rc.2 prep (STDLIB_GADGETS_VERSION constant, tarball-smoke tool count, tarball-smoke named-list).
  • Pre-publish gate as a hard prerequisite of publish — publish-gate.yml (source half + clean-room-consumer registry round-trip) blocks publish on packaging bugs invisible to monorepo builds (missing files, broken exports, transitive-dep gaps).
  • Smoke job hardened with 60-min npm replication wait + version equality check. rc.1's first smoke flake (registry CDN lag) cannot recur.
  • types condition first in exports — fixed in 3 packages (@ggui-ai/protocol, @ggui-ai/gadgets, @ggui-ai/react), 17 export entries reordered. Real consumer-side fix for TypeScript strict module resolution (bundler / nodenext).
  • Build is now warning-free — npm/pnpm env-var leakage cleaned up, Vite bundle-size threshold raised to match the project's actual gzip budget. 73 warnings → 0 across pnpm -r build.
  • Trusted Publishing (OIDC) replaces NPM_TOKEN — publish auth is now per-package OIDC config on npmjs.com (post the rc.2-debugging dance); no long-lived secret in CI. Each @ggui-ai/* tarball still carries the --provenance attestation.

Multi-provider work (from the cloud session)

  • Multi-provider routing through ui-gen — resolveRoute widened for the Bedrock + Anthropic + OpenAI + Gemini + OpenRouter pool. routeKind threaded end-to-end for per-route billing fidelity.
  • Default model = gemini-3.5-flash for the platform-key path; typed infra.model plumbed through the pod handlers.

Install

npm install @ggui-ai/cli@0.1.0-rc.3
# or via the prerelease dist-tag:
npm install @ggui-ai/cli@next

Verify provenance

Each tarball is signed via npm Trusted Publishing (OIDC). Verify on any @ggui-ai/* package page on npm; look for the "Provenance" badge linking back to the GitHub Actions run that built it.

Assets 2
Loading