npm-publish: the cli read-back gives the registry 60s and reports a successful publish as a failure

[lilyshen0722]

What happens

npm-publish.yml → job cli → step Read it back from the registry polls npm view @commonlyai/cli@<v> version six times at 10s and fails the job after 60s. The publish itself succeeds every time; the registry is just slower to serve the new version than 60s.

Measured today (2026-09-18):

run	head	result	registry afterwards
35343971690	0011545	cli: failure — @commonlyai/cli@0.1.48 not visible on the registry after publish	npm view @commonlyai/cli version → 0.1.48
35342949419	d620c25	same, for 0.1.47	0.1.47 was served
35307419890	5d067f4	same	served

The commonly-mcp job in the same runs succeeds, so it is the cli package's propagation time, not auth or the publish step.

Why it matters

A red publish run on every cli merge is the same signal as a real failure, so the real one (a version that did not publish) is now invisible. Tonight's chain has five cli PRs, each a publish; every one will show red.

Fix

Widen the read-back (e.g. 12 × 15s, three minutes), or read back through npm view --json with --prefer-online / a ?t= cache-bust so the run does not sit behind a stale registry edge. Keep the step failing on a true miss.

Not touching the workflow tonight: Lily holds the workflow scope, but the chain is mid-press and a workflow edit is a separate review.