Cuts the release that carries #41 (App mode gone from the skill) and #42
(reactions on the default token, judge model from the recipe), and fixes a
dependency the package should never have had.
THE PACKAGE DEPENDED ON ITSELF. 1.1.0 added `@orcarouter/code-review: ^1.0.2`
to its own `dependencies` and five releases carried it. Every `npx` therefore
downloaded a second, older copy of the CLI into node_modules before running the
one it came for — latency on the first thing a new user does, and RELEASE.md
already said the CLI has no dependencies. Nothing failed, which is why it
survived: the bin resolves from the top level, so the nested copy is dead
weight rather than a wrong entry point. A self-reference is also a registry
dependent, and npm reads dependents when deciding whether a version may be
withdrawn.
Pinned by a test rather than a note — `dependencies`, `peerDependencies` and
`optionalDependencies` must all be empty. The invariant was already documented
in prose and still broken for five releases.
2.0.0, not 1.5.1. 1.5.0 shipped the App-mode removal as a minor, and the
1.x line is being unpublished inside npm's 72-hour window, so 2.0.0 is the
first version on the registry that a user can actually install — the major is
where the break belongs, and a lone `1.5.1` would imply a history the packument
no longer has.
RELEASE.md records what went with the withdrawn versions, because a packument
with one version reads as a truncated upload. It also says plainly that
unpublishing was defensible only for a two-day-old line with no known
consumers, and that deprecation is the default everywhere else.
Three versions move together (gate 1): package.json, plugin.json,
marketplace.json.
2026-08-26 21:32:05 +08:00
6 changed files with 40 additions and 23 deletions
