chore: add prepublish guard against npm publish with workspace:* deps

小橘 <xiaoju@shazhou.work>

packages/cli/package.json

@@ -14,6 +14,7 @@
     "access": "public"
   },
   "scripts": {
+    "prepublishOnly": "bash ../../scripts/prepublish-check.sh",
     "build": "tsup",
     "test": "vitest run"
   },

packages/daemon/package.json

@@ -11,6 +11,7 @@
     "access": "public"
   },
   "scripts": {
+    "prepublishOnly": "bash ../../scripts/prepublish-check.sh",
     "build": "tsup",
     "test": "vitest run"
   },

scripts/prepublish-check.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+# Prevent npm publish from shipping workspace:* dependencies.
+# pnpm publish auto-converts them; npm publish does not.
+
+if [ -z "$npm_execpath" ] || [[ "$npm_execpath" != *pnpm* ]]; then
+  if grep -q '"workspace:' package.json; then
+    echo "❌ Detected workspace:* dependencies in package.json."
+    echo "   Use 'pnpm publish' instead of 'npm publish' to auto-convert them."
+    exit 1
+  fi
+fi