[nissa-seru]

TL;DR: scripts/release-changelog.mjs, the version hook that folds changelog.d/ into CHANGELOG.md, released whenever it ran, including by hand with --help. It now refuses unless its environment looks like a version command's version hook, as npm version, bun pm version and yarn version give it, a guard against running it by mistake. --help and -h print what it does and change nothing, whatever else is given, and without them any argument is refused.

We'll merge this not before 07:00 UTC on October 18, once our pre-merge checks pass on its merge with the then-current main, unless you ask for changes before then.

!Fixes #198

Problem

The script is package.json's version hook (node scripts/release-changelog.mjs && git add CHANGELOG.md changelog.d). It reads the new version from package.json, which npm version has already written when it runs the hook. It folds the fragments in changelog.d/ and the entries under ## Unreleased into a new ## X.Y.Z — date section, and deletes the fragments it folded. It took no arguments and didn't look at how it was run, so node scripts/release-changelog.mjs --help, or any run by hand, released into whatever version package.json already held. Anarchid found it while reviewing #156 (#198). The run there refused only because a ## 0.14.1 section already existed.

Changes

• It refuses unless npm_lifecycle_event is version and npm_command is version or unset. npm version gives its version hook both as version. bun pm version also bumps package.json and then runs the hook, but sets no npm_command, and it releases correctly on main, so an unset npm_command is accepted too. npm run version runs the same script with npm_command set to run and bumps nothing, and a preversion hook would run before the bump, so both variables are checked. release-changelog.mjs ignores its arguments and runs a release when invoked by hand #198 suggested checking npm_lifecycle_event alone, which still lets npm run version release. Any process can set these variables, so this guards against running the script by mistake, which is what release-changelog.mjs ignores its arguments and runs a release when invoked by hand #198 reports, not against running it on purpose. What each invocation sets, observed with npm 11.19.1, bun 1.4.3, pnpm 10.34.7 and yarn 1.22.22:

  Invocation	Bumps first	npm_command	npm_lifecycle_event	This check
  npm version patch	yes	version	version	passes
  bun pm version patch	yes	unset	version	passes
  yarn version --patch	yes	unset	version	passes
  npm run version	no	run	version	refuses
  bun run version	no	run-script	version	refuses
  pnpm run version	no	run-script	version	refuses
  yarn run version	no	unset	version	passes
  node scripts/release-changelog.mjs	no	unset	unset	refuses

  npm 7.24.2, 8.19.4, 9.9.4 and 10.9.9 set the same two values as 11.19.1 for npm version's hook, and pnpm version runs npm version. The yarn rows are yarn run as a global install runs it; through npx, which sets npm_command to exec, both are refused. yarn run version sets what yarn version sets, so this check can't tell them apart. The release's existing refusal of a version that already has a ## section still stops it whenever package.json holds a released version, as it stopped the run in release-changelog.mjs ignores its arguments and runs a release when invoked by hand #198. npm version <current> --allow-same-version also passes while bumping nothing; it's a deliberate version command, and the same refusal stops it for a released version. The other way round, a version command that sets no npm_command itself, launched by npx or from an npm script, inherits that runner's (exec, run), so it's refused after it has bumped package.json: observed with bun pm version run from an npm script, while npm version run the same way sets its own and passes. Run such a command directly.

• The refusal reads release-changelog: refused, and this script changed nothing: it runs only as the version hook of a version command such as `npm version <patch|minor|major>` …, names what it saw in both variables, says that a version bump made before it ran stays in package.json, and names node scripts/release-changelog.mjs --help for what it does. The release's refusal of a version that already has a section, which now stops yarn run version against a released version, says the same about changing nothing and about a bump, and to release the pending entries under a new version.

• --help or -h prints what the script does and how it's meant to run, and exits 0 without reading or touching anything, wherever it's run and whatever else is given. Without either, any argument is refused, since the script takes none. npm run version -- --help doesn't reach the script: npm appends the argument to the script string, so it goes to git add (observed), and the run is refused like any npm run version.

• No changelog fragment. Like the script's earlier fixes (c3253b1, 6fe1685, b5087e9), this changes only maintainer tooling, which no host or strategy author sees, so this pull request takes the no-changelog label.

What each part is for

The change should stop the script releasing when it's run by mistake, and make --help safe, while npm version, bun pm version and yarn version keep releasing as they do on main.

• The invocation check (one condition, scripts/release-changelog.mjs:248, with a comment on what the two variables can't see) is what stops a run by mistake. That covers a run by hand, which release-changelog.mjs ignores its arguments and runs a release when invoked by hand #198 reports, and also npm run version, bun run version, pnpm run version, a command npx starts and a preversion hook. Without it, a plain run that could release is stopped only by the release's refusal of a version that already has a section. That refusal works only while package.json holds a released version, as in release-changelog.mjs ignores its arguments and runs a release when invoked by hand #198, and its message then names the section, not how the script was run. When package.json holds a version with no section yet, such as after a bump made by hand or a release that stopped partway, a plain run would fold the fragments and delete them.

• Accepting an unset npm_command (one clause of that condition) keeps bun pm version and yarn version releasing, since neither sets it. The cost is that yarn run version passes too, since both variables look as they do under yarn version. The section refusal still stops it while package.json holds a released version.

• --help and -h first (one line, :241, plus the usage text). --help is how release-changelog.mjs ignores its arguments and runs a release when invoked by hand #198 was found. Refusing them as unknown arguments would be simpler, but release-changelog.mjs ignores its arguments and runs a release when invoked by hand #198 suggests handling --help, and someone asking the script what it does should get an answer.

• Refusing any other argument (one if, :242). The script takes none, and without this a flag it doesn't know, such as --dry-run, would be ignored and the release would run, as on main.

• The three refusal texts this change writes, for the invocation, an argument and a version that already has a section, say what the script saw and that nothing was changed. The invocation and argument refusals point to --help. The invocation and section refusals, the two of them that can follow a version command's bump, also say that the bump stays in package.json. That way whoever ran it knows the state they're in. They're text only.

• The test helper's default environment (one const) is npm version's hook's, so the 24 existing cases keep running as the hook runs them.

• The 13 new cases are:

  • one for each refused way of running it: by hand outside npm, npm run version, bun run version (whose run-script is what pnpm run version sets too), an npm_command of exec as npx gives, a preversion hook, and an unknown argument;
  • --help and -h, each in the hook's environment and outside npm;
  • --help after another argument;
  • the section refusal with no npm_command;
  • the bun pm version release.

  Each of the 9 removals listed under "Tests" fails at least one test.

Left out:

• A --dry-run preview, which release-changelog.mjs ignores its arguments and runs a release when invoked by hand #198 also suggests. It would need a second path through main() that writes nothing, and tests to keep that path from drifting from the real one. What it would show is already at hand: the fragments are plain files in changelog.d/, and a release in a scratch checkout writes the exact section. With the refusal, trying the script is already safe, so --dry-run is refused as an unknown argument and changes nothing.
• A bump check through git, comparing package.json's version with HEAD's. It would see whether package.json was bumped, which the environment can't show. So it would refuse yarn run version, which bumps nothing, and let a version command launched from an npm script release. It costs a git subprocess, the ways that can fail (no repository, no HEAD), and git fixtures in every test. The environment check covers what release-changelog.mjs ignores its arguments and runs a release when invoked by hand #198 reports.

Tests

At ec1023fb, on Linux x86_64, from a fresh npm ci:

• Merged onto main b0bbe64a: typecheck and build are clean, and npm test passes 1,459 of 1,459 on Node 24.22.0 and on Node 22.12.0. main passes 1,446 of 1,446 on both; the 13 more are this change's new cases.
• This branch (on main cd6ad3d6, Node 24.22.0): test/release-changelog.test.ts passes 37/37. With the script at main and this test file, 12 of the 37 fail: the 12 new refusal and help cases. The new bun pm version case passes there too, as a control, since main releases under it as well.
• Each of 9 deliberate removals fails at least one test: checking npm_lifecycle_event alone, checking npm_command alone, refusing an unset npm_command (which refuses bun pm version), refusing only run and run-script, no --help or -h, --help without -h, help only when it's the only argument, accepting other arguments, and printing the help and then releasing anyway.
• Through npm and bun themselves, each in a scratch git repository holding the release files and one fragment:
  • npm run version, npm run version -- --help and bun run version each exit 1 with the refusal and change nothing, and node scripts/release-changelog.mjs --help prints the usage.
  • npm version patch releases 0.15.1: it commits the new section, the bumped package.json and the fragment's deletion, and tags v0.15.1. bun pm version patch (bun 1.4.3) does the same, with nothing left uncommitted.
  • With main's script, the first two npm runs and the direct --help each tried to release, and refused only because ## 0.15.0 already exists.
• Merged with the other open pull requests, on Node 24.22.0 and on Node 22.12.0, at 8ffb97f1, which differs from this head only in a comment and one sentence of the section refusal. No other open pull request touches the script or its test.
  • With 12 of them merged in (feat(identity): witnessedIdentityReminder: inherited and lived history get their own reminders #129, chore(deprecate): ContextInjection and compile(injections) #140, feat(cache): first breakpoint at the end of the deep band, not the last head message #158, fix: send signed thinking only while the prefix it was minted under holds #160, docs: add a README #177, fix(compression): count cache writes and reads in every provider's input total (#182) #183, fix(store): reads leave out content that doesn't match ContentBlock, and writes refuse it (#184) #185, fix(kv-stable): the carried frontier keeps the overlap exemption #186, feat(errors): OverBudgetError.clearedBy says what clears a refusal #190, feat(diagnostics): log compile time on the plan-vs-actual line #200, fix(images): register the image watermark's state, and say when its write fails #202 and fix(autobiographical): moves counts the saved levels a compile changes (#195) #203), typecheck is clean and 1,645 of 1,645 tests pass.
  • fix(compression): progress past quarantined chunks; transient failures never spend the ladder; pace the lane #138 conflicts with fix(images): register the image watermark's state, and say when its write fails #202, and fix(kv-stable): phase C un-folds youngest by position, not deepest level first #156 with fix(kv-stable): the carried frontier keeps the overlap exemption #186, so those two ran with this branch in a tree of their own, where 1,592 of 1,592 pass.
  • feat(adaptive): [fold-diff] — which chunks moved between which levels, and where #157, RenderStats.nesting; the kv-overlap warning stops claiming a double render #130 and fix(merge): merge around quarantined sources; add operator merge holds #117 already conflict with main, and feat: folding-strategy migration utility (kv-stable ⇄ kv-unified) #94 is a draft, so they were left out.

The test helper now gives each case npm version's hook environment unless the case overrides it. The new cases run the script directly (both variables unset), through npm run version, through bun run version, with npm_command set to exec as npx gives a command it starts, as a preversion hook, and with an unknown argument, and each is refused with what it saw and leaves CHANGELOG.md and the fragments untouched. With npm_command unset against a version that already has a section, the section refusal stops the run and touches nothing. --help and -h each run both in the hook's environment and outside npm, against a fixture the release would refuse, and each prints the usage, exits 0 and changes nothing, as --help does after an unknown argument. They protect against what #198 reports, a run by hand that releases. The bun pm version case releases with npm_command unset, and protects the release path bun had before this change.

Out of scope

• agent-framework (14e25dc0), membrane (8242eb83) and chronicle (3575686) run the same scripts/release-changelog.mjs as their version hook, and connectome-host (38b55da) runs scripts/release-changelog.ts the same way. None checks how it's run.

---

• No changelog fragment: this change is internal-only (maintainer tooling), so it takes the no-changelog label.

Ezra-2423 read it internally, besides an automated internal review.

— Hamish-2699 (Claude Opus 5.5). Oscar-1808 (Claude Opus 5.5) decided that bun pm version keeps releasing, after Ezra-2423 found that an earlier head refused it. Anarchid reported the issue in #198.

[greptile-apps]

Confidence Score: 5/5

[Low impact] This PR appears safe to merge; no actionable issues were found.

Summary

Adds an invocation check to scripts/release-changelog.mjs so accidental direct runs refuse before reading or changing release files.

• The changelog release script checks its invocation before releasing a version.

_{Reviews (1) · Last reviewed commit: "fix(release): the section refusal says a..." · Reviewed by Greptile}