fix: address CodeRabbit review comments

- Add idempotent npm publish check to release workflow
- Add 20s timeout and remove latest fallback in npm install script
- Use execFileSync to avoid shell quoting issues in install script
- Handle signals in npm run wrapper
- Add final hard-budget guard in render logic to ensure token limit
- Update README npx example to be non-mutating

Co-Authored-By: Grey Newell <greyshipscode@gmail.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Made-with: Cursor

Author: greynewell

.github/workflows/release.yml

@@ -49,6 +49,12 @@ jobs:
           npm version "$VERSION" --no-git-tag-version --allow-same-version
 
       - name: Publish to npm
-        run: npm publish --access public
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          if npm view "uncompact@$VERSION" version >/dev/null 2>&1; then
+            echo "uncompact@$VERSION already exists on npm; skipping publish."
+            exit 0
+          fi
+          npm publish --access public
         env:
           NODE_AUTH_TOKEN: ${{ secrets.SUPERMODEL_NPM_TOKEN }}

README.md

@@ -76,7 +76,7 @@ npm install -g uncompact
 Or run without installing:
 
 ```bash
-npx uncompact install
+npx uncompact --help
 ```
 
 **Via Go:**

internal/template/render.go

@@ -193,6 +193,21 @@ func Render(graph *api.ProjectGraph, projectName string, opts RenderOptions) (st
 		}
 		result += note
 		resultTokens = CountTokens(result)
+
+		// Final hard-budget guard: if the appended note still pushes it over
+		if opts.MaxTokens > 0 && resultTokens > opts.MaxTokens {
+			noteTokens := CountTokens(buildNote(resultTokens))
+			budget := opts.MaxTokens - noteTokens
+			if budget < 1 {
+				budget = 1
+			}
+			truncated, truncatedTokens, truncErr := truncateToTokenBudget(graph, projectName, budget, graph.Stats.CircularDependencyCycles, opts.WorkingMemory, opts.SessionSnapshot, opts.ClaudeMD, opts.LocalMode, opts.Stale, staleDuration)
+			if truncErr != nil {
+				return "", 0, truncErr
+			}
+			result = truncated + buildNote(truncatedTokens)
+			resultTokens = CountTokens(result)
+		}
 	}
 
 	return result, resultTokens, nil

npm/install.js

@@ -3,7 +3,7 @@
 const https = require("https");
 const fs = require("fs");
 const path = require("path");
-const { execSync } = require("child_process");
+const { execSync, execFileSync } = require("child_process");
 const os = require("os");
 
 const REPO_OWNER = "supermodeltools";
@@ -56,6 +56,10 @@ function httpsGet(url) {
       response.on("end", () => resolve(Buffer.concat(chunks)));
       response.on("error", reject);
     });
+    request.setTimeout(20000, () => {
+      request.destroy();
+      reject(new Error(`Request timed out: ${url}`));
+    });
     request.on("error", reject);
   });
 }
@@ -68,11 +72,7 @@ async function getRelease(version) {
   if (version && version !== "0.0.0") {
     const tag = version.startsWith("v") ? version : `v${version}`;
     const url = `https://api.github.com/repos/${REPO_OWNER}/${REPO_NAME}/releases/tags/${tag}`;
-    try {
-      return await httpsGetJson(url);
-    } catch (err) {
-      console.log(`[uncompact] Release ${tag} not found, falling back to latest`);
-    }
+    return await httpsGetJson(url);
   }
   const url = `https://api.github.com/repos/${REPO_OWNER}/${REPO_NAME}/releases/latest`;
   return httpsGetJson(url);
@@ -81,7 +81,7 @@ async function getRelease(version) {
 function extractTarGz(buffer, destDir, binaryName) {
   const tarPath = path.join(destDir, "archive.tar.gz");
   fs.writeFileSync(tarPath, buffer);
-  execSync(`tar -xzf "${tarPath}" -C "${destDir}"`, { stdio: "pipe" });
+  execFileSync("tar", ["-xzf", tarPath, "-C", destDir], { stdio: "pipe" });
   fs.unlinkSync(tarPath);
 
   const extracted = path.join(destDir, binaryName);
@@ -96,9 +96,9 @@ function extractZip(buffer, destDir, binaryName) {
   fs.writeFileSync(zipPath, buffer);
 
   if (process.platform === "win32") {
-    execSync(`powershell -Command "Expand-Archive -Path '${zipPath}' -DestinationPath '${destDir}' -Force"`, { stdio: "pipe" });
+    execFileSync("powershell", ["-Command", `Expand-Archive -Path '${zipPath}' -DestinationPath '${destDir}' -Force`], { stdio: "pipe" });
   } else {
-    execSync(`unzip -o "${zipPath}" -d "${destDir}"`, { stdio: "pipe" });
+    execFileSync("unzip", ["-o", zipPath, "-d", destDir], { stdio: "pipe" });
   }
   fs.unlinkSync(zipPath);
 

npm/run.js

@@ -51,8 +51,12 @@ function main() {
     process.exit(1);
   });
 
-  child.on("close", (code) => {
-    process.exit(code ?? 0);
+  child.on("close", (code, signal) => {
+    if (code === null && signal) {
+      process.kill(process.pid, signal);
+    } else {
+      process.exit(code ?? 0);
+    }
   });
 }