feat: extract @codeoid/protocol workspace package (P0)

[saucam]

First step of the packages extraction (design doc §4): a single source of truth for the client↔daemon wire protocol, shared by the daemon, web UI, and the mobile client.

What changed

• Moved src/protocol/{types,scopes,index}.ts → packages/protocol/src/ (history preserved) and added the @codeoid/protocol package. Source-only — every consumer (Bun, Vite, Metro) transpiles TS, so no build step.
• Bun workspace ("workspaces": ["packages/*"]). The daemon depends on @codeoid/protocol (^0.1.0, linked locally) and keeps thin re-export shims at src/protocol/{types,scopes,index}.ts, so the 52 existing ../protocol/… imports resolve unchanged (zero churn across 44 files).
• release.yml publishes @codeoid/protocol (only when its version is new) before codeoid, so codeoid's published dependency resolves.

Why the coupling / sequencing

codeoid is published on npm and runs raw src, so once the daemon imports @codeoid/protocol, that package must be on npm or npm i -g codeoid breaks. This PR was intentionally sequenced after the #84 fix merged (it edited types.ts), and the daemon consumes the package via ^0.1.0 (linked locally now, resolves to the published version later).

⚠️ Action required before the next release

@codeoid/protocol needs its own npm Trusted Publisher configured at npmjs.com (same OIDC setup as codeoid) before the first release that publishes protocol 0.1.0. Until then the new release step no-ops for unchanged versions but will fail when it first tries to publish 0.1.0.

Verification

• tsc --noEmit clean; biome check src/ clean.
• bun run build bundles @codeoid/protocol (384 modules).
• Full suite: 786 pass, 0 fail.

Not in this PR (follow-ups)

• Web UI: still uses its hand-maintained web/src/protocol/types.ts mirror. Migrating it to consume @codeoid/protocol is deferred — web is a separate package with its own Vite build + lockfile, so joining it to the workspace and swapping the mirror deserves its own verified PR rather than risking the web build here.
• @codeoid/core: the ws client + reducers + formatters (the larger, Solid-decoupling extraction).

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added a shared protocol package for common app communication and permission scope definitions.
  • Published the protocol package as a workspace dependency so it can be consumed consistently across the project.

• Bug Fixes

  • Updated npm publishing to avoid republishing an already released protocol version.
  • Improved release publishing to use trusted publishing with provenance for both packages.

• Documentation

  • Added guidance on using the shared protocol package and compatibility rules for future updates.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 4259cb73-8280-41a7-8409-08bb9c5c48c8

📥 Commits

Reviewing files that changed from the base of the PR and between 7e42070 and 428cc6c.

⛔ Files ignored due to path filters (1)

• bun.lock is excluded by !**/*.lock, !**/*.lock, !bun.lock

📒 Files selected for processing (11)

• .github/workflows/release.yml
• package.json
• packages/protocol/README.md
• packages/protocol/package.json
• packages/protocol/src/index.ts
• packages/protocol/src/scopes.ts
• packages/protocol/src/types.ts
• packages/protocol/tsconfig.json
• src/protocol/index.ts
• src/protocol/scopes.ts
• src/protocol/types.ts

---

📝 Walkthrough

Walkthrough

Extracts wire-protocol types and permission scopes into a new @codeoid/protocol npm package with its own package.json, tsconfig, and README. Root package.json adds workspace/dependency wiring. Existing src/protocol/* files become re-export shims. Release workflow adds conditional npm publish for the new package.

Changes

Protocol Package Extraction

Layer / File(s)	Summary
Package scaffolding and workspace wiring packages/protocol/package.json, packages/protocol/tsconfig.json, packages/protocol/README.md, package.json	New @codeoid/protocol package definition (ESM, entrypoints, exports map, published files), its tsconfig extending root config, README documenting usage, plus root workspace packages/* and new dependency.
Wire-protocol type definitions packages/protocol/src/types.ts	Full protocol v2 type surface: session/usage types, content parts, tool state machine, client/daemon message unions, search/fs/config messages, auth context and helper.
Permission scopes and package index packages/protocol/src/scopes.ts, packages/protocol/src/index.ts	SCOPES, Scope type, role-scoped arrays, hasScope/hasAllScopes helpers, and index re-exports of types/scopes.
Local protocol shims src/protocol/index.ts, src/protocol/scopes.ts, src/protocol/types.ts	Existing local files replaced with wildcard re-exports from @codeoid/protocol, removing local definitions.
Release workflow publish step .github/workflows/release.yml	Adds a conditional publish step for @codeoid/protocol that checks npm view before publishing, and relabels the subsequent codeoid publish step.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• saucam/codeoid#25: Both PRs modify .github/workflows/release.yml to switch npm publishing to OIDC Trusted Publishing and adjust npm publish --provenance --access public steps.
• saucam/codeoid#26: Related patch release work implementing the same tokenless OIDC publishing pipeline in release.yml.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and accurately summarizes the main change: extracting @codeoid/protocol into a workspace package.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/extract-protocol-package

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install failed. For unrecoverable errors, disable the tool in CodeRabbit configuration.

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.86%. Comparing base (7e42070) to head (428cc6c).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #101   +/-   ##
=======================================
  Coverage   75.85%   75.86%           
=======================================
  Files          66       69    +3     
  Lines       11308    11312    +4     
=======================================
+ Hits         8578     8582    +4     
  Misses       2730     2730           

Flag	Coverage Δ
daemon	75.86% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
packages/protocol/src/index.ts	100.00% <100.00%> (ø)
packages/protocol/src/scopes.ts	100.00% <100.00%> (ø)
packages/protocol/src/types.ts	100.00% <100.00%> (ø)
src/protocol/scopes.ts	100.00% <100.00%> (ø)
src/protocol/types.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.