[onmax]

pnpm's no-downgrade policy rejects comark-annotate@0.9.1 because older releases used staged publishing with npm approval. Direct GitHub OIDC publishing still has provenance, but pnpm ranks the older approval step higher.

This keeps releases automatic from GitHub, with no npm approval. Release verification now checks GitHub trusted-publisher and provenance metadata. The installation docs explain the history and show exact-version exceptions for annotate, carousel, and zoom. The agent skill links to that guidance when this error occurs. Consumers still need to accept the publishing change in their own pnpm policy.

pnpm ready and docs generation pass. A real 0.9.1 install fails for those three packages without exceptions, succeeds with the documented exceptions, and runs the annotation CLI successfully.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-11-04T16:29:09.614787Z We couldn’t complete this review. Comment @codex review to try again.	470a768	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[vite-hub]

Session	Status	Started	Duration
Pending	Completed	Not started	—

Latest result

Pull request merged.

Final answers

Session

Pull request merged.

Session

Waiting for GitHub merge request 8ae06a88-23b8-4c8e-93ed-2d04f58be576.

Session

Pushed 5a4dba3 fixing Pullfrog’s P1 staged-approval acceptance and P2 hidden publisher metadata; resolved both threads. Registry regression cases using jq, documented npm view, bash -n, vp fmt --check, and git diff --check passed. Docs lint was blocked locally by unbuilt comark-linter/dist/doctor.mjs. Awaiting CI and automated review.

Session

Pushed 5a4dba3 fixing Pullfrog’s P1 staged-approval acceptance and P2 hidden publisher metadata; resolved both threads. Registry regression cases using jq, documented npm view, bash -n, vp fmt --check, and git diff --check passed. Docs lint was blocked locally by unbuilt comark-linter/dist/doctor.mjs. Awaiting CI and automated review.

Session

Pushed 5a4dba3 fixing Pullfrog’s P1 staged-approval acceptance and P2 hidden publisher metadata; resolved both threads. Registry regression cases using jq, documented npm view, bash -n, vp fmt --check, and git diff --check passed. Docs lint was blocked locally by unbuilt comark-linter/dist/doctor.mjs. Awaiting CI and automated review.

Session

Pushed 5a4dba3 fixing Pullfrog’s P1 staged-approval acceptance and P2 hidden publisher metadata; resolved both threads. Registry regression cases using jq, documented npm view, bash -n, vp fmt --check, and git diff --check passed. Docs lint was blocked locally by unbuilt comark-linter/dist/doctor.mjs. Awaiting CI and automated review.

Session

Pushed 5a4dba3 fixing Pullfrog’s P1 staged-approval acceptance and P2 hidden publisher metadata; resolved both threads. Registry regression cases using jq, documented npm view, bash -n, vp fmt --check, and git diff --check passed. Docs lint was blocked locally by unbuilt comark-linter/dist/doctor.mjs. Awaiting CI and automated review.

Session

Pushed 5a4dba3 fixing Pullfrog’s P1 staged-approval acceptance and P2 hidden publisher metadata; resolved both threads. Registry regression cases using jq, documented npm view, bash -n, vp fmt --check, and git diff --check passed. Docs lint was blocked locally by unbuilt comark-linter/dist/doctor.mjs. Awaiting CI and automated review.

Session

Pushed 5a4dba3 fixing Pullfrog’s P1 staged-approval acceptance and P2 hidden publisher metadata; resolved both threads. Registry regression cases using jq, documented npm view, bash -n, vp fmt --check, and git diff --check passed. Docs lint was blocked locally by unbuilt comark-linter/dist/doctor.mjs. Awaiting CI and automated review.

Session

Pushed 5a4dba3 fixing Pullfrog’s P1 staged-approval acceptance and P2 hidden publisher metadata; resolved both threads. Registry regression cases using jq, documented npm view, bash -n, vp fmt --check, and git diff --check passed. Docs lint was blocked locally by unbuilt comark-linter/dist/doctor.mjs. Awaiting CI and automated review.

Session

Pushed 5a4dba3 fixing Pullfrog’s P1 staged-approval acceptance and P2 hidden publisher metadata; resolved both threads. Registry regression cases using jq, documented npm view, bash -n, vp fmt --check, and git diff --check passed. Docs lint was blocked locally by unbuilt comark-linter/dist/doctor.mjs. Awaiting CI and automated review.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[pullfrog]

Important

The new release check does not yet verify the direct-publishing transition, and the documented inspection command hides one of the fields readers are told to review.

Reviewed changes in commit 470a768, covering the release verification gate and the new pnpm trust guidance.

• Release verification — Requires each published version to expose GitHub trusted-publisher metadata and SLSA v1 provenance before the release succeeds.
• Consumer guidance — Documents ERR_PNPM_TRUST_DOWNGRADE, exact-version exclusions, metadata review, and a local CLI smoke test.
• Agent guidance — Directs agents to the policy documentation and requires user authorization before adding an exception.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using gpt-5.6-sol ｜ 𝕏}

[pkg-pr-new]

Open in StackBlitz

comark-annotate

pnpm add https://pkg.pr.new/comark-annotate@352

comark-badge

pnpm add https://pkg.pr.new/comark-badge@352

comark-cards

pnpm add https://pkg.pr.new/comark-cards@352

comark-carousel

pnpm add https://pkg.pr.new/comark-carousel@352

comark-cast

pnpm add https://pkg.pr.new/comark-cast@352

comark-charts

pnpm add https://pkg.pr.new/comark-charts@352

comark-chat

pnpm add https://pkg.pr.new/comark-chat@352

comark-chips

pnpm add https://pkg.pr.new/comark-chips@352

comark-cjk

pnpm add https://pkg.pr.new/comark-cjk@352

comark-code

pnpm add https://pkg.pr.new/comark-code@352

comark-code-notes

pnpm add https://pkg.pr.new/comark-code-notes@352

comark-colors

pnpm add https://pkg.pr.new/comark-colors@352

comark-comments

pnpm add https://pkg.pr.new/comark-comments@352

comark-critic

pnpm add https://pkg.pr.new/comark-critic@352

comark-deflist

pnpm add https://pkg.pr.new/comark-deflist@352

comark-details

pnpm add https://pkg.pr.new/comark-details@352

comark-diagrams

pnpm add https://pkg.pr.new/comark-diagrams@352

comark-diff

pnpm add https://pkg.pr.new/comark-diff@352

comark-embed

pnpm add https://pkg.pr.new/comark-embed@352

comark-fields

pnpm add https://pkg.pr.new/comark-fields@352

comark-figure

pnpm add https://pkg.pr.new/comark-figure@352

comark-file-tree

pnpm add https://pkg.pr.new/comark-file-tree@352

comark-footnotes

pnpm add https://pkg.pr.new/comark-footnotes@352

comark-github

pnpm add https://pkg.pr.new/comark-github@352

comark-icon

pnpm add https://pkg.pr.new/comark-icon@352

comark-include

pnpm add https://pkg.pr.new/comark-include@352

comark-keys

pnpm add https://pkg.pr.new/comark-keys@352

comark-links

pnpm add https://pkg.pr.new/comark-links@352

comark-linter

pnpm add https://pkg.pr.new/comark-linter@352

comark-magic-move

pnpm add https://pkg.pr.new/comark-magic-move@352

comark-mark

pnpm add https://pkg.pr.new/comark-mark@352

markdown-it-to-comark

pnpm add https://pkg.pr.new/markdown-it-to-comark@352

marked-to-comark

pnpm add https://pkg.pr.new/marked-to-comark@352

comark-mathml

pnpm add https://pkg.pr.new/comark-mathml@352

comark-media

pnpm add https://pkg.pr.new/comark-media@352

comark-metrics

pnpm add https://pkg.pr.new/comark-metrics@352

migrate-to-comark

pnpm add https://pkg.pr.new/migrate-to-comark@352

comark-outline

pnpm add https://pkg.pr.new/comark-outline@352

comark-properties

pnpm add https://pkg.pr.new/comark-properties@352

comark-qr

pnpm add https://pkg.pr.new/comark-qr@352

comark-quiz

pnpm add https://pkg.pr.new/comark-quiz@352

comark-reading-time

pnpm add https://pkg.pr.new/comark-reading-time@352

remark-to-comark

pnpm add https://pkg.pr.new/remark-to-comark@352

comark-sources

pnpm add https://pkg.pr.new/comark-sources@352

comark-steps

pnpm add https://pkg.pr.new/comark-steps@352

comark-table

pnpm add https://pkg.pr.new/comark-table@352

comark-tabs

pnpm add https://pkg.pr.new/comark-tabs@352

comark-tests

pnpm add https://pkg.pr.new/comark-tests@352

comark-time

pnpm add https://pkg.pr.new/comark-time@352

comark-ui

pnpm add https://pkg.pr.new/comark-ui@352

comark-xref

pnpm add https://pkg.pr.new/comark-xref@352

comark-zoom

pnpm add https://pkg.pr.new/comark-zoom@352

commit: 5a4dba3

[pullfrog]

✅ No new issues found.

Reviewed changes since the prior Pullfrog review, focusing on the direct-publishing verification fix and corrected inspection guidance.

• Rejected staged approvals — Added an _npmUser.approver absence check so staged-and-approved releases no longer satisfy the direct GitHub publishing gate.
• Clarified verification failures — Updated workflow errors and summaries to identify direct trusted publishing as the required state.
• Exposed trusted-publisher metadata — Requested _npmUser.trustedPublisher.id explicitly in the documented npm view command.

Validated the workflow predicate against live npm manifests: staged comark-annotate@0.2.0 is rejected and direct comark-annotate@0.9.1 is accepted. The documented command also displays the expected github publisher ID.

  ^{｜ View workflow run ｜ Using gpt-5.6-sol ｜ 𝕏}