Published @unbraind/pm-cli package is unavailable from npm (metadata and tarball return 404)

Production impact

Fresh npm/bun installs of every package that depends on @unbraind/pm-cli are currently blocked. Local release gates can pass from an existing cache, masking the outage.

Verified on 2026-07-26

npm view @unbraind/pm-cli@2026.7.26 version
# E404 Not Found - GET https://registry.npmjs.org/@unbraind%2fpm-cli

curl https://registry.npmjs.org/%40unbraind%2Fpm-cli
# HTTP 404

curl https://registry.npmjs.org/@unbraind/pm-cli/-/pm-cli-2026.7.26.tgz
# HTTP 404

The authenticated npm identity is unbrained, the public GitHub release v2026.7.26 exists, and downstream package-lock.json files resolve to that exact npm tarball URL. The unscoped pm-changelog@2026.7.26 metadata remains available, so this is specific to the scoped CLI package rather than general registry connectivity.

Expected

@unbraind/pm-cli@2026.7.26 is publicly retrievable from a clean unauthenticated environment.
The daily release gate verifies both registry metadata and a hermetic fresh npm and bun install after publication, without relying on local caches.
If the package was intentionally made private/unpublished, downstream public packages should not declare the unavailable registry dependency.

Suggested acceptance test

Use isolated HOME/npm cache/bun cache directories, fetch the public registry metadata/tarball, then run fresh npm install/npx pm --version and bun install/bunx pm --version.

Found while validating unbraind/pm-web#65. Related history: #681 covers a prior dist-tag problem, but not the current package-wide 404.

🔗 Related PRs

#302 - Optimize npm package SDK installs [merged]
#406 - feat(mcp): extension-aware built-in actions + action-scoped name schema (pm-zumn, pm-fq80) [merged]
#428 - Harden SDK extension runtime packaging [merged]
#480 - Expose SDK package lifecycle primitives [merged]
#670 - Recover same-day npm releases with an explicit stable dist-tag [merged]

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

Create Plan

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

feat: adopt typed pm SDK dispatch with cursor pagination (#65)

Tracked by pm-7zs0, the canonical recurring release-health record. Hermetic anonymous metadata and tarball checks reproduce the 404. The active recovery makes release verification use empty credentials and fresh npm/Bun caches, and rerunning the existing tag will restore public access with npm access set status=public without cutting a second daily version.

The code-side recovery is merged, but production remains externally blocked.

PR Harden SDK usage errors and npm public visibility recovery #748 merged the credential-free verifier and same-tag recovery.
PR Recover hidden npm releases before immutable publication #750 merged access-first, fail-closed recovery.
Release run 30209544683 restored literal 100% coverage on its exact rerun and passed every gate through package dogfood, then npm returned E403 for npm access set status=public @unbraind/pm-cli.
Fresh anonymous metadata still returns 404; npm access get status @unbraind/pm-cli reports private.
The release-environment NPM_TOKEN can publish but lacks package-settings/access authority. Local npm authentication is unavailable, so this session cannot safely change visibility.

Required maintainer action: use an npm account/token authorized to manage @unbraind/pm-cli package access to set it public, and replace/upgrade the GitHub release environment NPM_TOKEN so npm access set status=public is permitted. Then rerun .github/workflows/release.yml with tag=v2026.7.26.

PM system of record: pm-7zs0.

Tracked in pm-2z9263, filed against the root cause rather than the reported symptom.

The published package is not missing. npm view @unbrained/pm-cli version returns 2026.7.26 from a clean environment, and both npx and bunx execute that artifact. The 404 in this report comes from the scope spelling: @unbraind (the GitHub organisation) versus @unbrained (the npm scope), one transposed letter apart.

The reason that spelling looked authoritative is a real defect, and it is what the tracker item now owns. .github/workflows/release.yml names @unbraind/pm-cli in its publish guard and access-recovery branch, while scripts/release/verify-published-release.mjs correctly names @unbrained/pm-cli in the very next step. So the idempotence guard always 404s and can never take its skip branch, the advertised access recovery can never act on the real package, and two contract specs assert the wrong spelling as expected text. There is also a standing supply-chain exposure: @unbraind is an unclaimed npm scope named by our own workflow and by shipped source.

Closing this issue against that root cause.

Closing as not reproducible against the real package. Root cause and remediation are tracked in pm-2z9263.

Navigation Menu

Repository navigation

Published @unbraind/pm-cli package is unavailable from npm (metadata and tarball return 404) #746

Production impact

Verified on 2026-07-26

Expected

Suggested acceptance test

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Published @unbraind/pm-cli package is unavailable from npm (metadata and tarball return 404) #746

Description

Production impact

Verified on 2026-07-26

Expected

Suggested acceptance test

Activity

coderabbitai commented on Jul 26, 2026

unbraind commented on Jul 26, 2026

unbraind commented on Jul 26, 2026

unbraind commented on Jul 26, 2026

unbraind commented on Jul 26, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions