[ef-35] fix: skip npm similarity-blocked aliases gracefully

docs/package-aliases.md

@@ -22,14 +22,16 @@ To eliminate this surface, **we pre-emptively own all common misspellings and fo
 
 **Formatting variants** — different ways to write "failproof ai":
 
-| Package | Install command |
-|---------|----------------|
-| `failproof` | `npm install -g failproof` |
-| `failproof-ai` | `npm install -g failproof-ai` |
-| `fail-proof-ai` | `npm install -g fail-proof-ai` |
-| `failproof_ai` | `npm install -g failproof_ai` |
-| `fail_proof_ai` | `npm install -g fail_proof_ai` |
-| `fail-proofai` | `npm install -g fail-proofai` |
+| Package | Install command | Status |
+|---------|----------------|--------|
+| `failproof` | `npm install -g failproof` | ✅ published |
+| `failproof-ai` | `npm install -g failproof-ai` | ⏳ pending npm support approval |
+| `fail-proof-ai` | `npm install -g fail-proof-ai` | ⏳ pending npm support approval |
+| `failproof_ai` | `npm install -g failproof_ai` | ⏳ pending npm support approval |
+| `fail_proof_ai` | `npm install -g fail_proof_ai` | ⏳ pending npm support approval |
+| `fail-proofai` | `npm install -g fail-proofai` | ⏳ pending npm support approval |
+
+> **Why pending?** npm's spam-prevention policy blocks registration of names that normalize to the same string as an existing package after stripping punctuation (e.g. `failproof-ai` → `failproofai`). We have contacted npm support to reserve these names for anti-squatting purposes. They will be activated once approved.
 
 **`failprof*` typos** — missing one `o` from "proof":
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "0.0.1-beta.8",
+  "version": "0.0.1-beta.9",
   "description": "Open-source hooks, policies, and project visualization for Claude Code & Agents SDK",
   "bin": {
     "failproofai": "./bin/failproofai.mjs"

scripts/publish-aliases.mjs

@@ -29,6 +29,8 @@ const ALIASES = [
   'faliproofai',
 ];
 
+const warnings = [];
+
 for (const name of ALIASES) {
   const tmpDir = join('/tmp', `npm-alias-${name}-${Date.now()}`);
   const binDir = join(tmpDir, 'bin');
@@ -55,11 +57,29 @@ for (const name of ALIASES) {
     console.log(`[dry-run] Would publish ${name}@${VERSION}`);
     console.log(JSON.stringify(pkg, null, 2));
     console.log('---');
-  } else {
-    console.log(`Publishing ${name}@${VERSION}...`);
-    execSync('npm publish', { cwd: tmpDir, stdio: 'inherit' });
+    rmSync(tmpDir, { recursive: true, force: true });
+    continue;
+  }
+
+  console.log(`Publishing ${name}@${VERSION}...`);
+  try {
+    execSync('npm publish', { cwd: tmpDir, stdio: 'pipe' });
     console.log(`Done: ${name}`);
+  } catch (err) {
+    const output = (err.stdout?.toString() ?? '') + (err.stderr?.toString() ?? '');
+    if (output.includes('too similar')) {
+      warnings.push(`${name}: blocked by npm similarity check — request via npm support`);
+    } else if (output.includes('cannot publish over')) {
+      console.log(`[skip] ${name}: already published at ${VERSION}`);
+    } else {
+      warnings.push(`${name}: ${output.trim().split('\n').find(l => l.includes('npm error')) ?? 'unknown error'}`);
+    }
   }
 
   rmSync(tmpDir, { recursive: true, force: true });
 }
+
+if (warnings.length > 0) {
+  console.log('\n::warning::Some alias packages were not published:');
+  for (const w of warnings) console.log(`  - ${w}`);
+}