A guided command for preparing an npm release, including version selection, changeset checks, compatibility review, and a release pull request. Changesets are files that describe package changes and help determine the next version.

Use it to prepare patch, minor, or major releases, audit missing changesets, review package compatibility, and create the release work.

It reduces missed release notes, incorrect version bumps, and unnoticed compatibility changes while leaving publishing and merging under human control.

How jo-duchan/tapflow configures Claude Code

About the project

tapflow is a self-hosted service that runs iOS simulators and Android emulators in a web browser, letting teams view mobile builds, streams, and recordings on infrastructure they control. Mobile QA teams and other developers use it to test apps without relying on shared physical devices or uploading builds to a cloud provider. The catalogue entries support operating tapflow and its mobile testing workflows.

jo-duchan/tapflow · 1,616 stars · on GitHub · tapflow.dev

Reuse

Borrowing it

Nothing to install: this file belongs to jo-duchan/tapflow. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/jo-duchan/tapflow/main/.claude/commands/release.md

Clone the repo

git clone --depth 1 https://github.com/jo-duchan/tapflow

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/commands/jo-duchan/tapflow/release/github.svg)](https://agentmods.dev/commands/jo-duchan/tapflow/release)

Your own site

<a href="https://agentmods.dev/commands/jo-duchan/tapflow/release"><img src="https://agentmods.dev/badge/commands/jo-duchan/tapflow/release/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/commands/jo-duchan/tapflow/release"><img src="https://agentmods.dev/badge/commands/jo-duchan/tapflow/release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 22 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 6,162 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00022	$0.06162
Opus 5.5	$0.00009	$0.02465
Sonnet 5.5	$0.00004	$0.01232
Haiku 4.5	$0.00002	$0.00616

Measured 16d ago against content hash 68bee2910451, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

release scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 16d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

doc=$(curl -sf --max-time "$left" "https://registry.npmjs.org/$(printf '%s' "$name" | sed 's|/|%2f|')") \

.claude/commands/release.md · 267 lines

How it starts

The opening of the file, as written. The whole thing — 267 lines — stays where its author put it; the contents beside it link to each section on GitHub.

다음 npm 릴리즈를 준비한다. 인자로 bump 레벨(major/minor/patch)을 줄 수 있고, 없으면 근거를 모아 직접 추천한다: $ARGUMENTS

가이드형으로 진행한다 — 각 판단 지점에서 멈춰 사용자와 합의하고, 위험 단계 전에 확인받는다. 자동으로 push/merge/publish 하지 않는다.

1. 현황 수집 (evidence-based)

현재 버전: publish 패키지들의 package.json
git log v{latest}..HEAD --oneline(머지 포함/제외 각각) — feat / fix / perf / breaking 분류
열린 PR: gh pr list
대기 중인 changeset: .changeset/*.md
누락된 changeset 감사: pnpm changeset:audit — 마지막 태그 이후 머지 중 배포 소스를 바꿨는데 changeset이 없는 것을 나열한다. PR 게이트(CI changeset job)는 새 PR만 막으므로 이미 머지된 것은 여기서만 잡힌다. v0.17.0 준비 때 이 누락(#410~#413)을 수작업으로 발견한 것이 이 감사를 만든 계기다. 나오면 릴리즈 전에 백필하되, 백필 changeset 본문에 Backfills: #413을 한 줄로 넣는다 — 감사는 머지 단위로 판정하므로 그 줄이 없으면 원래 머지를 사이클 내내 계속 지목한다
.changeset/config.json의 fixed / ignore 그룹 재확인

2. bump 레벨 추천 → 사용자 합의

SemVer 0.x 기준: feat 추가 = minor, 버그픽스만 = patch, 1.0 승격은 별도 논의(안정성 선언이라 아껴둔다).
이번 사이클의 테마 한 줄을 뽑는다(릴리즈노트 제목이 된다).
프로토콜/인터페이스 변경 커밋이 있으면 → 3번 호환성 검증.
추천 버전을 제시하고 합의를 받은 뒤 진행한다.

3. 호환성 검증 (프로토콜/인터페이스 변경 시에만)

변경 범주: WebSocket envelope/메시지, 공개 API 시그니처, CLI 커맨드·플래그, DB 스키마.
있으면 새 e2e를 돌리지 말고, 해당 PR의 기존 검증 + 단위테스트의 backward-compat 케이스를 코드로 확인한다. (예: agent-core/envelope.test.ts의 backward compatible 케이스, ios-agent codec negotiation의 version-skew 폴백 케이스)
backward-compat면 minor로 충분 → 릴리즈노트에 "호환 유지" 근거 인용.
아니면 사용자에게 보고하고 릴리즈노트 상단에 경고 + breaking 여부 재논의.

4. 브랜치

git checkout main && git pull origin main — 항상 최신 main에서 시작.
git checkout -b release/vX.Y.Z

5. changeset 작성/보완

이번 테마를 담은 changeset이 없으면 추가한다(기본 changelog 생성기는 changeset 본문만 CHANGELOG에 넣으므로, 핵심 변경이 changeset에 없으면 누락된다).
fixed 그룹(tapflow·agent-core·ios-agent·android-agent·relay·flow-runner·mcp-server)은 멤버 하나만 명시해도 전체가 동반 bump되지만, CHANGELOG 본문은 명시된 패키지에만 들어간다 → 본문이 필요한 핵심 패키지를 모두 명시한다.

6. 버전 적용

pnpm changeset version
fixed 그룹 7개가 함께 X.Y.Z로 올랐는지, changeset 파일이 소비됐는지 확인.

7. 이 레포 전용 수동 단계 (놓치기 가장 쉬움)

떠도는 dist-tag 훑기: 배포 패키지 전부의 dist-tag를 나열하고 latest가 아닌 것을 찾는다.

Read the full file on GitHub · 267 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

16d ago Changed · +2 lines 68bee2910451
18d ago Changed · +10 lines 50107dcd36de
1mo ago Changed · +7 lines 7d64283dc618
1mo ago Changed · +3 lines a835c1320ccd
2mo ago Changed 3c2eef0708f1
2mo ago First seen · 245 lines · 22 tokens per session scan A a442b87024d8

Subscribe to this mod's changes

release is a command published in the GitHub repository jo-duchan/tapflow (1,616 stars, last pushed yesterday), licensed MIT. It adds 22 tokens to every session and 6,162 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Git and workflow Releases android android-emulator app-testing appetize-alternative ios react-native

release next to 6 commands from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
releasejo-duchan/tapflow	Command	1.6k	yesterday	MIT	A	22	Claude Code
changelogscarrillo/release	Command	9	1mo ago	MIT	A	11	Claude Code
releasescarrillo/release	Command	9	1mo ago	MIT	A	12	Claude Code
copilotkelvinkosbab/AppBootstrapAI	Command	8	today	MIT	A	19	Claude Code
claudekelvinkosbab/AppBootstrapAI	Command	8	today	MIT	A	19	Claude Code
cursorkelvinkosbab/AppBootstrapAI	Command	8	today	MIT	A	0	Claude Code
figma-startnaver/design-to-ui	Command	8	2mo ago	Apache-2.0	A	49	Claude Code

tapflow: Command for Claude Code