Improvement candidates — markpost-cli — August 30th, 2026

[grimicorn-agent]

Automated weekly scan. Check the boxes for the improvements you want turned into tracked issues, then close this issue when you're done triaging — closing it is the go signal. On its next run the agent creates the checked items as real issues (unassigned, labelled by priority) and leaves this digest closed; unchecked items are dismissed and won't be re-proposed. While this stays open nothing happens, so take as long as you need.

• mpcli-20260830-1 npm publish ships no dist, so the installed markpost binary is missing — /dist is gitignored with no files allowlist, no .npmignore, and no prepublishOnly/prepack build step, so npm publish excludes the compiled output the bin points to. (suggested: Bug, effort: S)
• mpcli-20260830-2 CI never runs npm run build, so a production-build-only break ships undetected — CI runs lint, typecheck (tsconfig.test.json), and test:ci, but never npm run build — the step that produces the published artifact. (suggested: P2, effort: S)
• mpcli-pr139-1 Guard create/update against non-interactive terminals — sources create (always prompts) and sources update with no uuid (opens a picker) hang or abort under pipes/cron the same way delete did before this PR; extend the same both-streams TTY guard to them. (suggested: P3, effort: S, from PR Confirm before deleting a source; --yes skips for scripts #139)
• mpcli-pr138-1 Back off the mark-synced burst on a sustained 429 — A rate-limited mark-synced run fires every remaining PATCH (per-record MARK_FAILED); a bulk caller should abort the burst to back off while keeping the daemon alive. (suggested: P3, effort: S, from PR Stop the autoSync daemon on a permanent mark-synced failure #138)
• mpcli-20260823-4 Add markpost --version / -v to print the installed CLI version — Wire a top-level version flag so a globally-installed user can confirm which @markpost/cli version they're running. (suggested: P3, effort: S)

Rationale

• mpcli-20260830-1: package.json declares bin markpost=./dist/index.js and the only way to produce dist/ is npm run build. .gitignore contains /dist and there is no .npmignore or files field, so npm packs everything except dist/ — the published tarball has no dist/index.js. No prepublishOnly/prepack so publish never rebuilds. Fix: add files:[dist] and prepublishOnly:npm run build.
• mpcli-20260830-2: ci.yml runs lint/typecheck/test:ci but not build. Production build is tsc && tsc-alias over tsconfig.json (different include/paths than test config), so a break reachable only through the real build passes CI green and ships to npm. Adding npm run build closes it.
• mpcli-pr139-1: sources create (always prompts) and sources update with no uuid (opens a picker) hang or abort under pipes/cron the same way delete did before this PR; extend the same both-streams TTY guard to them.
• mpcli-pr138-1: Per the api.ts contract a bulk caller should abort the burst to back off on a sustained 429, e.g. a dedicated MARK_RATE_LIMITED outcome and a rate-limited abort reason, while keeping the daemon alive.
• mpcli-20260823-4: src/index.ts dispatch only recognizes help tokens (HELP_COMMANDS = help/--help/-h); there is no --version/-v path, so a user who npm install -g @markpost/cli has no in-CLI way to check their version. package.json (already imported in libs/config.ts as packageJson) carries the version, so this is a tiny self-contained addition.