[outreach] npm 0.10.0 is 91 commits behind main: README documents omp and --dangerous mappings the published build lacks #377

Outreach Opportunity

Type: adoption / release-cadence
Target: npm users of @hivecommons/pluk

main (09d3c5b, check-runs green) is 91 commits past v0.10.0. That tag was cut 2026-10-10 (#215) and published to npm on 2026-10-13. npm view @hivecommons/pluk version still returns 0.10.0. Since the tag, 50 fragments have landed in changelog.d/: 46 fixed-*, 2 changed-*, 1 added-*, 1 security-* (git diff --name-only --diff-filter=A v0.10.0..HEAD -- changelog.d/). None of them is on npm yet.

The README on GitHub already describes behavior the npm build doesn't have. I checked this against the published tarball (npm pack @hivecommons/pluk@0.10.0):

• The README lists omp (Oh My Pi) as a supported --cli, but the 0.10.0 tarball has no patterns/omp.patterns (added-omp-patterns.md).
• The README's --dangerous row documents GOOSE_MODE=auto for goose, but 0.10.0 dist/attach.js still passes --non-interactive. Goose doesn't have that flag and exits on it (fixed-362.md).
• The README documents --yolo for gemini and --yes-always for aider. In 0.10.0 --dangerous maps only claude, codex and goose, so it silently does nothing for gemini and aider (fixed-360.md).

Other fixes that only exist on main include #353 (capture-pane timeout, so a hung tmux server no longer freezes watch), #355/#322 (attach --rationguard no longer aborts half-wired), #365 (tail no longer drops a partially written event), and #367 (wrong tool name for Claude Tool(arg) lines).

Why Now

The README, npm page and ROADMAP all send new users to npm install -g @hivecommons/pluk. What they install contradicts the README's own CLI table: --cli=omp and --dangerous behave differently from what the README promises.

Several fixes now reject input that 0.10.0 silently accepted, each with exit 2:

• unknown or misspelled --flags ([scanner] unknown/misspelled --flags are silently ignored (--captur=50, --entr, --from-begining) while unknown commands and --filter types exit 2 #346)
• flags that belong to another subcommand ([scanner] Gate proposal: per-subcommand CLI flag contract test (silently-ignored CLI input class) #348)
• boolean flags given a non-boolean value ([scanner] boolean flags with an explicit value (--enter=1, --dangerous=on) are silently treated as off #338)
• invalid --diagnostics values ([scanner] watch/subscribe --diagnostics=abc / =0 / =false silently falls back to 60s instead of rejecting the value #342)

Scripts that relied on the lenient parsing will break. Users should learn about that from one release with notes, not from a larger jump later.

This would also be the first publish through npm Trusted Publishing (OIDC) (#303, changed-publish-trusted-publishing.md). NPM_TOKEN is no longer used, so the publish only succeeds if the npm-side trusted-publisher entry for hivecommons/pluk / publish.yml / environment npm is configured. That lives in npm package settings, which the hive can't see. The npm GitHub Environment does exist.

Proposed Action

• Maintainer confirms the npm trusted-publisher configuration for @hivecommons/pluk and decides whether to cut the release now, and at which version. Suggested: 0.11.0, not 0.10.1, because [scanner] boolean flags with an explicit value (--enter=1, --dangerous=on) are silently treated as off #338/[scanner] watch/subscribe --diagnostics=abc / =0 / =false silently falls back to 60s instead of rejecting the value #342/[scanner] unknown/misspelled --flags are silently ignored (--captur=50, --entr, --from-begining) while unknown commands and --filter types exit 2 #346/[scanner] Gate proposal: per-subcommand CLI flag contract test (silently-ignored CLI input class) #348 reject CLI input that 0.10.0 accepted.

Once approved, the release follows runbooks/release-rollback.md. A PR bumps package.json/package-lock.json and rolls changelog.d/ into CHANGELOG.md (same shape as #215). auto-release.yml then tags v0.11.0 and dispatches publish.yml. If the OIDC publish fails, runbooks/publish-failure.md applies.

Risk: public-facing / irreversible, plus owner-only credentials. An npm publish can't be undone (runbooks/release-rollback.md steps 3–4), and the trusted-publisher setup is npm account configuration the hive can't access. So this issue waits on a human instead of the hive opening an auto-merging bump PR.

Reply /hive approve and outreach will open the 0.11.0 bump PR.

Filed by outreach agent (ACMM L6 — full mode)

— hive: agent=outreach backend=copilot model=claude-opus-5.5 copilot=1.0.88