BlobPipe npm preview

The public package family is @flyrobin620/blobpipe-acp, @flyrobin620/blobpipe-win32-x64, and @flyrobin620/blobpipe-linux-x64. The initial version is 0.1.0-preview.1, with the preview dist-tag. Source remains in the private flyrobin620/blobpipe repository. No new license is granted.

Consumer prerequisites

Install Node 24+ and npm. Supported systems are Windows x64 and Linux x64 with glibc (the Linux binary is built on Ubuntu 24.04; older glibc is not verified). macOS, ARM64 and musl are unsupported. The native executable is self-contained; it does not need an installed .NET runtime. MCP/configure need Python 3.10+ using only the standard library. Set BLOBPIPE_PYTHON to one executable path if needed. Live transport needs Azure Blob data permissions and network reachability, plus authenticated Azure CLI for azure-cli credentials (or native managed identity). The remote ACP agent, for example Copilot CLI, needs its own installation and authentication. Installing this package does not install or authenticate these tools.

npm install --save-exact @flyrobin620/[email protected]
npx blobpipe-acp --version
npx blobpipe-acp native --help
npx blobpipe-acp path
npx blobpipe-acp configure --help

Keep optional dependencies enabled: the main package binds both platform packages to the exact same version. No lifecycle scripts or postinstall downloads exist. Unsupported/missing/mismatched packages fail closed, without downloading a fallback. native and mcp preserve child stdin/stdout/stderr and exit codes; diagnostics go to stderr. --version prints the npm distribution version; native --version retains its existing transport protocol version banner (BlobPipe 0.1).

Create a private fixture beneath an ignored .local directory: {"schemaVersion":1,"credential":"azure-cli","containerUri":"https://YOUR_ACCOUNT.blob.core.windows.net/YOUR_CONTAINER"}. Then run blobpipe-acp configure --fixture .local/fixture.json --local-cwd ABSOLUTE_LOCAL_PATH --remote-cwd ABSOLUTE_REMOTE_PATH --output .local/profile.json. The helper selects this package's exact native binary and prints a registration command for review; it never registers the MCP server automatically. Use blobpipe-acp mcp --config .local/profile.json as the MCP stdio command. After an upgrade or moving the installation, regenerate the profile. At startup, the launcher rejects profiles pointing at a different native binary. The adapter continues to treat later local profile edits as trusted configuration. Remote server setup and live Azure/Copilot operation are separate prerequisites.

Release operator

release.yml is manual and main-only. Every run builds and tests this repository on Windows and Linux, then packs an explicit file allowlist with SHA-256 records. It never downloads original organization Releases. The publish job uses environment npm-release; configure its deployment branch restriction to selected branch main before dispatching. Verify the environment setting via GitHub API before enabling publishing. PR jobs have only contents: read and no npm secret or OIDC write permission.

Run prepare first to inspect package/build artifacts and registry availability; it does not publish. bootstrap uses the environment secret NPM_BOOTSTRAP_TOKEN for the initial three packages only and verifies npm whoami is flyrobin620. It refuses any preexisting package name. Token creation and npm account ownership must be verified by the account holder; GitHub identity is not npm authentication.

Create a granular token on npmjs.com: Packages and scopes -> Read and write (publish and stage) -> Only select packages and scopes -> scope @flyrobin620; Organizations -> No access. Select the shortest practical expiry (at least one day) and Bypass two-factor authentication for noninteractive publishing. This does not disable account 2FA. Scope selection covers initial scoped packages; do not grant all-account package access if the scope is unavailable: stop and resolve with npm. Save the token directly in the GitHub environment secret, never in chat or Git. Delete/revoke it after bootstrap and the OIDC configuration below.

For each published package, its npm Settings -> Trusted Publisher must bind GitHub owner flyrobin620, repository blobpipe, workflow filename release.yml, environment npm-release, with direct npm publish explicitly allowed. The oidc mode has id-token: write on its publish job only and no token secret. It runs on GitHub-hosted Ubuntu with Node 24 and npm 11.5.1+. Use a reviewed version bump for the next release; existing versions are immutable. Private source repositories support trusted publishing but cannot generate npm provenance. This workflow explicitly disables provenance and publishes its own source/build/file hash records, which are not an npm/Sigstore attestation.

Publication writes publication.json before each irreversible attempt, and records successful writes separately from registry integrity verification. If publication partially succeeds, retain the run artifacts and inspect npm metadata before acting. Never delete packages or blindly retry; bootstrap deliberately refuses a partial family. A reviewed recovery/version decision is required. OIDC is implemented but is not proven configured or operational until an actual OIDC publish succeeds.

After publishing, clean Windows/Linux hosted consumers install from npmjs with an empty cache and verify installed payload hashes, native entrypoints and offline MCP initialize/ping/eight tools/profile discovery. This does not verify live Azure or Copilot access. Managed local devices may enforce a seven-day npm package age gate; hosted consumption does not prove local policy admission and must not bypass it.

Official references (checked 2026-09-18):

• https://docs.npmjs.com/trusted-publishers/ - private-repository limitation applies to provenance; setup begins in existing package settings.
• https://docs.npmjs.com/creating-and-viewing-access-tokens/ - granular scope selection, publish/stage permissions, 2FA bypass and minimum expiry.
• https://docs.npmjs.com/staged-publishing/ - staging requires an existing package; it cannot publish a brand-new package or bootstrap an OIDC trust.
• https://docs.npmjs.com/about-access-tokens/ - direct-publish tokens remain available in September 2026 but are scheduled for removal in January 2027.