From 404c9c3fd7087063a925eb23ed891b4fa5ed91f2 Mon Sep 17 00:00:00 2001
From: Zach Kelling <z@zeekay.io>
Date: Tue, 3 Nov 2026 19:45:57 -0800
Subject: [PATCH] ci: npm whoami diagnostic, robust

---
 .github/workflows/npm-whoami.yml | 13 ++++++-----
 npm/install.js                   | 37 ++++++++++++++++++++++++--------
 2 files changed, 34 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/npm-whoami.yml b/.github/workflows/npm-whoami.yml
index 67426c05d..cd3a108e0 100644
--- a/.github/workflows/npm-whoami.yml
+++ b/.github/workflows/npm-whoami.yml
@@ -16,15 +16,14 @@ jobs:
           ORG_NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           ORG_NPM_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
         run: |
-          set -uo pipefail
-          curl -fsSL https://raw.githubusercontent.com/hanzoai/ci/1983074a463e15d3c21efd7925babbddedd5daaf/bin/kms -o "$RUNNER_TEMP/kms"
-          KMS_TOKEN=$(bash "$RUNNER_TEMP/kms" NPM_TOKEN prod)
+          curl -fsSL https://raw.githubusercontent.com/hanzoai/ci/1983074a463e15d3c21efd7925babbddedd5daaf/bin/kms -o "$RUNNER_TEMP/kms" || echo "kms script fetch failed"
+          KMS_TOKEN=$(bash "$RUNNER_TEMP/kms" NPM_TOKEN prod 2>"$RUNNER_TEMP/kms.err") || echo "kms read failed: $(head -c 300 "$RUNNER_TEMP/kms.err")"
           for name in KMS_TOKEN ORG_NPM_TOKEN ORG_NPM_AUTH_TOKEN; do
             tok="${!name:-}"
-            [ -n "$tok" ] || { echo "$name: (empty)"; continue; }
+            echo "$name: length=${#tok}"
+            if [ "${#tok}" -lt 8 ]; then continue; fi
             echo "::add-mask::$tok"
             printf '//registry.npmjs.org/:_authToken=%s\n' "$tok" > "$RUNNER_TEMP/npmrc"
-            who=$(NPM_CONFIG_USERCONFIG="$RUNNER_TEMP/npmrc" npm whoami --registry https://registry.npmjs.org 2>&1 | tail -1)
-            perm=$(NPM_CONFIG_USERCONFIG="$RUNNER_TEMP/npmrc" npm access list collaborators @hanzo/cli --json 2>/dev/null | tr -d '\n ' | head -c 300)
-            echo "$name: whoami=$who"
+            echo "$name: whoami=$(NPM_CONFIG_USERCONFIG="$RUNNER_TEMP/npmrc" npm whoami --registry https://registry.npmjs.org 2>&1 | tail -1)"
           done
+          exit 0
diff --git a/npm/install.js b/npm/install.js
index 1348b5aa5..4910d53c6 100644
--- a/npm/install.js
+++ b/npm/install.js
@@ -15,7 +15,7 @@
 // binaries (`dev`, `mcp`, `engine`, `node`, `zt`, `vm`, `gen`) are fetched
 // lazily on first use by `bin/hanzo.js` (or eagerly with `HANZO_NPM_EAGER=1` /
 // `node install.js --all`).
-const { createWriteStream, mkdirSync, chmodSync, copyFileSync, existsSync, renameSync, symlinkSync, unlinkSync } = require("node:fs");
+const { createWriteStream, mkdirSync, chmodSync, copyFileSync, existsSync, symlinkSync, unlinkSync, writeFileSync } = require("node:fs");
 const { createHash } = require("node:crypto");
 const { rm } = require("node:fs/promises");
 const { join } = require("node:path");
@@ -151,16 +151,35 @@ async function fetchEngine({ key, dest, ext }) {
     dest,
   });
 
-  const extracted = join(dest, `hanzoai${ext}`);
-  const out = join(dest, `hanzo-engine${ext}`);
-  if (existsSync(extracted)) {
-    if (existsSync(out)) unlinkSync(out);
-    renameSync(extracted, out);
-  }
-  if (existsSync(out) && process.platform !== "win32") chmodSync(out, 0o755);
-  linkAlias(dest, "hanzo-engine", "hanzoai", ext);
+  const engine = join(dest, `hanzoai${ext}`);
+  if (existsSync(engine) && process.platform !== "win32") chmodSync(engine, 0o755);
+  writeFileSync(join(dest, "hanzo-engine"), ENGINE_ADAPTER, { mode: 0o755 });
 }
 
+// The CLI runs `hanzo-engine serve -m MODEL [engine args…]` (commands/engine.rs).
+// The released engine binary (`hanzoai`) has no `serve`: it takes its options
+// first and then a model selector, and serves HTTP only when given a port. This
+// adapter is that translation, and nothing else: any other argv passes through.
+const ENGINE_ADAPTER = `#!/bin/sh
+# hanzo-engine: adapts \`serve -m MODEL [opts]\` to the released engine binary.
+here=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+engine="$here/hanzoai"
+[ "\${1:-}" = serve ] || exec "$engine" "$@"
+shift
+model=""; port=""; set -- "$@" --hanzo-end
+while [ "$1" != --hanzo-end ]; do
+  case "$1" in
+    -m|--model) model="$2"; shift 2 ;;
+    -p|--port) port="$2"; shift 2 ;;
+    --overlay) shift 2 ;;
+    *) set -- "$@" "$1"; shift ;;
+  esac
+done
+shift
+[ -n "$model" ] || { echo "hanzo-engine: serve needs -m MODEL" >&2; exit 2; }
+exec "$engine" --port "\${port:-\${HANZO_ENGINE_PORT:-1234}}" "$@" run -m "$model"
+`;
+
 async function fetchVm({ key, dest, ext }) {
   const vmTarget = VM_TARGETS[key];
   if (!vmTarget) {