Repository navigation
Conversation
One package, two uses: npx guardrails-md pre-commit (CLI) and 'plugin': ['guardrails-md'] (opencode plugin). The old scoped package (@bergetai/opencode-guardrails-md) will be deprecated with a pointer.
AI Review could not runCaution The model provider returned an authentication or availability error. Check the API key and provider status. Berget AI (berget/zai-org/GLM-5.3-Flash) |
![berget-ai[bot]](https://avatars.githubusercontent.com/u/160869282?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review
Summary
Renames the npm package from the scoped @bergetai/guardrails-md to the harness-neutral unscoped guardrails-md (description em-dash re-encoded as \u2014, EOF newline dropped), and updates the metadata test to match.
Risk
MEDIUM — the diff itself is mechanically correct, but it renames a package that is live on npm (@bergetai/guardrails-md@0.7.0 is the current latest; verified via registry), which orphans existing installs and breaks the OIDC trusted-publishing setup until registry-side config is updated.
Issues
- 🟠 warning
package.json:2— Verified on the npm registry:@bergetai/guardrails-mdis published at 0.7.0 andguardrails-mdis free; consumers installing the scoped name will silently stop receiving updates and the PR ships no migration note (README:97–98 documents the previous rename at 0.5.1 but is not updated for this one). Plan a deprecation (npm deprecate @bergetai/guardrails-md "renamed to guardrails-md") plus a README migration section before releasing. - 🟠 warning
package.json:2—.github/workflows/publish.ymlpublishes via OIDC trusted publishing, which npm binds per package name (the workflow comment at lines 26–28 says the Trusted Publisher is configured for@bergetaion this repo); a Trusted Publisher entry for the new unscopedguardrails-mdmust be created on npmjs.com before the next release ornpm publishwill fail. - 🟡 nit
package.json:66— Trailing newline at EOF was dropped (git shows\ No newline at end of file), which adds diff noise to future edits. - 🟡 nit
package-lock.json:2— Lockfile root still says@bergetai/guardrails-md(lines 2 and 8); empiricallynpm ci --dry-runstill succeeds, but regenerate withnpm installto keep metadata in sync. (File not in diff — prose only.) - 🟡 nit
README.md:93,97-98,106andSECURITY.md:15-16— Install instructions ("plugin": ["@bergetai/guardrails-md"],pi install npm:@bergetai/guardrails-md) and the published-package reference in SECURITY.md now contradict the new canonical name. (Files not in diff — prose only.)
Suggestions
package.json— After merge, release asguardrails-md@0.7.1(or 0.8.0) only after configuring the npm Trusted Publisher for the new name, thennpm deprecate @bergetai/guardrails-mdand update README/SECURITY install snippets.package.json— Restore the trailing newline:printf '\n' >> package.json.
Architecture
No structural change; .claude-plugin/plugin.json and marketplace.json already use guardrails-md, so this aligns package.json with existing plugin metadata — the accompanying test update keeps the version-sync invariant intact.
Code quality score: 9/10 — minimal, test-updated-in-lockstep metadata change; the only real work left is release hygiene outside the diff.
Berget AI (berget/zai-org/GLM-5.3-Flash) | PR #23
| @@ -1,7 +1,7 @@ | |||
| { | |||
| "name": "@bergetai/guardrails-md", | |||
| "name": "guardrails-md", | |||
There was a problem hiding this comment.
🟠 warning — Renaming a published package (verified live: @bergetai/guardrails-md@0.7.0 on npm) orphans existing consumers — add a npm deprecate/migration plan like the 0.5.1 rename documented in README.
| @@ -1,7 +1,7 @@ | |||
| { | |||
| "name": "@bergetai/guardrails-md", | |||
| "name": "guardrails-md", | |||
There was a problem hiding this comment.
🟠 warning — publish.yml uses OIDC trusted publishing bound to the old name — configure a Trusted Publisher for guardrails-md on npmjs.com before the next release or publish fails.
| "vitest": "^5.0.3" | ||
| } | ||
| } | ||
| } No newline at end of file |
There was a problem hiding this comment.
🟡 nit — Trailing newline at EOF was dropped; restore it to avoid diff noise.
| it("Given one package for every harness, When package.json is checked, Then it has the harness-neutral name and the pi-package keyword", () => { | ||
| const pkg = JSON.parse(readFileSync(join(import.meta.dirname, "package.json"), "utf8")) | ||
| expect(pkg.name).toBe("@bergetai/guardrails-md") | ||
| expect(pkg.name).toBe("guardrails-md") |
There was a problem hiding this comment.
✅ good — Test updated in lockstep with the rename, keeping the metadata invariant enforced.
| - The gate code in this repository (core.ts and the opencode and pi adapters | ||
| in adapters/, and the Claude Code hooks module in hooks/register.ts). | ||
| - The published npm package `@bergetai/guardrails-md` (formerly | ||
| - The published npm package `guardrails-md` (formerly |
There was a problem hiding this comment.
🟡 nit — The "formerly" chain skips the 0.6.x–0.7.0 era name @bergetai/guardrails-md — add it so users of that package can trace the rename (guardrails-md, formerly @bergetai/guardrails-md, formerly @bergetai/opencode-guardrails-md).
Follow-up reviewNew changes: 2 commits — 37ec658 restores the package.json EOF newline and genuinely regenerates package-lock.json (the context's file list omits it, but Previous findings:
New findings:
Credit where due: the lockfile/newline follow-up was done exactly as requested. Inline findingsBerget AI (berget/zai-org/GLM-5.3-Flash) | PR #23 |
One package, two uses:
npx guardrails-md pre-commit(CLI) and"plugin": ["guardrails-md"](opencode plugin). The old scoped package will be deprecated.