fix(check-publish): only fail on workspace: specs the publish step cannot resolve

[pyramation]

Summary

check-publish failed on any workspace: spec in dist/package.json, which rejects the normal monorepo layout: pnpm/lerna rewrite those specs to concrete versions at publish time (@agentic-kit/anthropic@1.16.0 ships "@agentic-kit/protocol": "1.16.0"). Since makage build runs the check, that made 0.7 unadoptable in workspaces that use workspace:* internal deps.

The check now resolves each spec against the workspace's own package versions and only fails when nothing in the workspace provides the dependency — i.e. when the publish step genuinely cannot substitute a version:

workspace:*  + pkg@1.16.0 in workspace -> 1.16.0    OK
workspace:^  + pkg@1.16.0 in workspace -> ^1.16.0   OK
workspace:^1.2.3                       -> ^1.2.3    OK (published verbatim)
workspace:*  + pkg not in workspace    -> unresolvable, exit 1

Workspace versions come from pnpm-workspace.yaml via the existing findWorkspacePackageFiles helper. --strict restores the old behavior (reject every workspace: spec).

Link to Devin session: https://app.devin.ai/sessions/bb89d57636c84c7383305191a303b1d4
Open in Devin Desktop: https://app.devin.ai/desktop/session/bb89d57636c84c7383305191a303b1d4?variant=devin
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[tenki-reviewer]

Review complete. 🟡 2 medium

💬 Inline comments (2)

• 🟡 --strict does not reject all workspace: specs — checkPublish.ts:45
• 🟡 Non-pnpm workspaces get empty version map — checkPublish.ts:115

---

This PR introduces a new checkPublish command that scans package manifests for workspace: specs that cannot be resolved against the workspace's actual versions, failing the check when a spec would publish an unresolvable dependency. It wires the command into the CLI with a --strict flag and adds tests covering the resolution paths.

Files	Change
packages/makage/src/commands/checkPublish.ts	New command: reads workspace versions, resolves each workspace: spec, and reports unresolved leaks; --strict broadens the rejection set.
packages/makage/src/cli.ts	Registers the checkPublish command and its --strict flag.
packages/makage/__tests__/checkPublish.test.ts	Adds unit tests for spec resolution and strict-mode behavior.

_{Reviewed commit: c423c42}

[tenki-reviewer]

Adds a checkPublish command that detects unresolved workspace: dependency specs in package manifests and rejects them, with an opt-in --strict mode.

Key findings

• 🟡 --strict does not reject all workspace: specs — checkPublish.ts:45
• 🟡 Non-pnpm workspaces get empty version map — checkPublish.ts:115

[tenki-reviewer]

🟡 bug · medium

--strict does not reject all workspace: specs

The --strict flag documented in packages/makage/src/cli.ts:76 as "rejects all" only empties the versions map (checkPublish.ts:45), but resolveWorkspaceSpec returns explicit ranges like workspace:^1.2.3 verbatim (checkPublish.ts:105) even when no workspace version is available, so those specs still resolve and pass strict mode. Only star/bare/caret/tilde specs are rejected, contradicting the documented contract and the flag's intent.

📋 Prompt for AI Agents

In packages/makage/src/commands/checkPublish.ts around lines 45-50, make --strict reject every workspace: spec: when strict is true, mark all leaks as unresolved (set resolvedVersion to undefined for every leak) instead of relying only on the empty versions map, since resolveWorkspaceSpec (line 105) returns explicit ranges verbatim even with no workspace version. This aligns behavior with the --strict rejects all contract documented in packages/makage/src/cli.ts:76-77.

[tenki-reviewer]

🟡 bug · medium

Non-pnpm workspaces get empty version map

readWorkspaceVersions (packages/makage/src/commands/checkPublish.ts:115) reads only pnpm-workspace.yaml, yet findWorkspaceRoot (packages/makage/src/commands/workspace.ts:6) also recognizes lerna.json and a package.json workspaces field as workspace markers. When the root is found through those other markers the YAML read throws and the catch returns an empty version map, so every workspace:*, workspace:^, and workspace:~ spec is reported unresolvable and runCheckPublish falsely exits 1 on a package that would publish fine.

📋 Prompt for AI Agents

In packages/makage/src/commands/checkPublish.ts readWorkspaceVersions (lines 108-131), the function reads only pnpm-workspace.yaml, but findWorkspaceRoot (packages/makage/src/commands/workspace.ts) can return a root detected via lerna.json or a package.json workspaces field. For those workspace types the YAML read throws and the function returns an empty version map, causing runCheckPublish to falsely report every workspace:*/^/~ spec as unresolvable and exit(1). Make version discovery honor the marker that identified the root: when pnpm-workspace.yaml is absent, parse lerna.json packages or the root package.json workspaces array and resolve manifests from there so versions are populated for lerna/npm workspaces too.