release-headlesslisted

Gotchas for the agents-cli headless release. The macOS home base signs, notarizes, and npm-publishes over SSH with no GUI and no Touch ID — three things must be primed or the release stalls. Triggers on: release stuck at sign/publish, errSecInternalComponent, "no npmjs.com bundle", "Missing embedded.provisionprofile", making the release autonomous.
phnx-labs/agents-cli · ★ 18 · AI & Automation · score 70

Install: claude install-skill phnx-labs/agents-cli

# Headless release — home-base gotchas `apps/cli/scripts/release.sh` orchestrates from any fleet box (Linux included) but routes the privileged phase — build + sign + notarize + `npm publish` — to the macOS **home base** over SSH. That phase runs with **no GUI session and no Touch ID**, so three things must be primed. When a release dies after "CI all-green, merged, tagged" but nothing lands on npm, it is almost always one of these. Everything below is host-agnostic: resolve the home base from the release script, never hardcode a path. ## 1. Secrets bundles must be unlocked (locked ≠ empty) The home base reads two file-backed secret bundles headlessly: - `npmjs.com` → `NPM_TOKEN` (the publish token) - `apple.com` → `APPLE_ID`, `APPLE_APP_SPECIFIC_PASSWORD`, `APPLE_TEAM_ID`, `CSC_NAME` (notarization) They are decrypted with `AGENTS_SECRETS_PASSPHRASE`, which `headless-sign-context.sh` loads from an on-disk pass file. **The failure mode:** if a bundle was re-encrypted with a different passphrase (drift), or is simply locked, a headless `agents secrets export <bundle> --plaintext` returns **empty** — and the release reports `no 'npmjs.com' secrets bundle on <home base>`, which looks identical to the bundle being missing. - **Diagnose, don't assume.** A `0 keys` listing over SSH can mean **locked**, not empty. Check for the encrypted blob on disk (`agents-cli.bundles.<name>.enc`) — if it exists, the bundle is real and just unreadable headlessly. `AGENTS_SECRETS_PASSPHRA