fix(vscode): make publishing survive a flaky registry

A timeout mid-run aborted the loop, leaving one target live, four unattempted
and the release untagged. Transient failures now retry with backoff, a failed
target no longer stops the others, an auth failure stops everything at once,
and the summary names which targets are live so a re-run can finish the job.

Author: elkaix

apps/vscode/scripts/ovsx-publish.mjs

@@ -3,6 +3,7 @@ import { existsSync } from 'node:fs';
 
 import { runLocalCli } from './local-cli.mjs';
 import { parsePublishArguments, publishUsage } from './publish-args.mjs';
+import { messageOf, publishEachTarget } from './publish-retry.mjs';
 import { extensionRoot, isMainModule } from './vsix-targets.mjs';
 import { verifyVsix } from './vsix-verify.mjs';
 
@@ -15,22 +16,24 @@ async function main() {
   if (!process.env.OVSX_PAT) throw new Error('OVSX_PAT is required to publish.');
 
   await verifyInputs(options);
-  for (const file of options.files) {
-    console.log(`Publishing verified package ${file}...`);
-    try {
-      runLocalCli('ovsx', 'ovsx', ['publish', file], {
-        cwd: extensionRoot,
-        encoding: 'utf8',
-        stdio: 'pipe',
-      });
-    } catch (error) {
-      if (/already exists/i.test(error instanceof Error ? error.message : String(error))) {
-        console.log(`Package already exists: ${file}`);
-        continue;
+  await publishEachTarget({
+    targets: options.targets,
+    files: options.files,
+    registry: 'Open VSX',
+    publishOne: (file) => {
+      try {
+        runLocalCli('ovsx', 'ovsx', ['publish', file], {
+          cwd: extensionRoot,
+          encoding: 'utf8',
+          stdio: 'pipe',
+        });
+        return 'published';
+      } catch (error) {
+        if (/already exists/i.test(messageOf(error))) return 'skipped';
+        throw error;
       }
-      throw error;
-    }
-  }
+    },
+  });
 }
 
 async function verifyInputs(options) {

apps/vscode/scripts/publish-retry.mjs

@@ -0,0 +1,106 @@
+// Publishing to a registry fails in three different ways, and they need three
+// different responses: a flaky network call should be retried, a bad token
+// should stop everything immediately, and a rejected package should fail only
+// its own target so the remaining ones still ship.
+const TRANSIENT_PATTERN =
+  /request timeout|etimedout|econnreset|econnrefused|enotfound|eai_again|socket hang up|network|\b(?:429|500|502|503|504)\b|too many requests|service unavailable|gateway/i;
+const AUTH_PATTERN = /\b401\b|unauthorized|invalidaccess|access denied|not allowed|forbidden|\b403\b|authentication|invalid token|expired/i;
+
+export const DEFAULT_ATTEMPTS = 3;
+
+export function messageOf(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+/**
+ * `auth` aborts the whole run — every remaining target would fail identically.
+ * `transient` is worth retrying. `fatal` fails one target and lets the rest go.
+ */
+export function classifyError(error) {
+  const message = messageOf(error);
+  if (AUTH_PATTERN.test(message)) return 'auth';
+  if (TRANSIENT_PATTERN.test(message)) return 'transient';
+  return 'fatal';
+}
+
+function delay(ms) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+
+/**
+ * Runs `action`, retrying only transient failures with a widening backoff.
+ * Returns the action's value; rethrows the last error once attempts run out.
+ */
+export async function withRetry(action, options = {}) {
+  const attempts = options.attempts ?? DEFAULT_ATTEMPTS;
+  const label = options.label ?? 'operation';
+  const backoffMs = options.backoffMs ?? [5000, 15000];
+
+  for (let attempt = 1; ; attempt += 1) {
+    try {
+      return await action();
+    } catch (error) {
+      const kind = classifyError(error);
+      if (kind !== 'transient' || attempt >= attempts) {
+        throw error;
+      }
+      const wait = backoffMs[Math.min(attempt - 1, backoffMs.length - 1)];
+      console.warn(`${label}: ${kind} failure on attempt ${attempt}/${attempts}, retrying in ${wait / 1000}s...`);
+      console.warn(`  ${messageOf(error).split('\n')[0]}`);
+      await delay(wait);
+    }
+  }
+}
+
+/**
+ * Publishes every target, keeping going after a per-target failure so one flaky
+ * upload cannot strand the rest. Throws a summary naming exactly which targets
+ * are live and which still need a re-run, because a half-published version is
+ * the state that is hardest to reason about afterwards.
+ */
+export async function publishEachTarget({ targets, files, registry, publishOne }) {
+  const published = [];
+  const skipped = [];
+  const failures = [];
+  let abortReason = '';
+
+  for (let index = 0; index < targets.length; index += 1) {
+    const target = targets[index];
+    const file = files[index];
+    if (abortReason) {
+      failures.push({ target, message: `not attempted (${abortReason})` });
+      continue;
+    }
+    console.log(`Publishing verified package ${file}...`);
+    try {
+      const outcome = await withRetry(() => publishOne(file, target), { label: `${registry} ${target}` });
+      (outcome === 'skipped' ? skipped : published).push(target);
+    } catch (error) {
+      const kind = classifyError(error);
+      failures.push({ target, message: messageOf(error).split('\n')[0] });
+      if (kind === 'auth') {
+        abortReason = 'aborted after an authentication failure';
+      }
+    }
+  }
+
+  summarize({ registry, published, skipped, failures });
+  if (failures.length > 0) {
+    throw new Error(
+      `${registry}: ${failures.length} of ${targets.length} target(s) failed. ` +
+        `Published targets are live and will be skipped on a re-run — fix the cause and run the publish command again.`,
+    );
+  }
+  return { published, skipped };
+}
+
+function summarize({ registry, published, skipped, failures }) {
+  console.log(`\n${registry} summary:`);
+  if (published.length > 0) console.log(`  published: ${published.join(', ')}`);
+  if (skipped.length > 0) console.log(`  already published: ${skipped.join(', ')}`);
+  for (const failure of failures) {
+    console.log(`  FAILED ${failure.target}: ${failure.message}`);
+  }
+}

apps/vscode/scripts/release-extension.mjs

@@ -127,7 +127,20 @@ async function main() {
   run('git', ['add', 'apps/vscode/package.json']);
   run('git', ['commit', '-m', `chore(vscode): release ${version}`]);
 
-  run('pnpm', ['--filter', 'pythinker-code', 'run', 'publish:vsix'], { env: { ...process.env, VSCE_PAT: vscePat } });
+  try {
+    run('pnpm', ['--filter', 'pythinker-code', 'run', 'publish:vsix'], { env: { ...process.env, VSCE_PAT: vscePat } });
+  } catch (error) {
+    // The version bump is already committed and some targets may already be
+    // live, so say exactly how to finish rather than leaving it to be worked out.
+    throw new Error(
+      `${error instanceof Error ? error.message : String(error)}\n\n` +
+        `${version} is partly published and NOT tagged. The publish summary above lists which\n` +
+        `targets are live; published ones are skipped on a re-run. Finish with:\n` +
+        `  pnpm --filter pythinker-code run publish:vsix\n` +
+        `  git tag -a ${tag} -m "Pythinker Code VS Code extension ${version}"\n` +
+        `Do not bump the version again — ${version} is already consumed.`,
+    );
+  }
 
   const ovsxPat = process.env.OVSX_PAT || keychainSecret(OVSX_KEYCHAIN_SERVICE);
   if (ovsxPat) {

apps/vscode/scripts/vsix-publish.mjs

@@ -3,6 +3,7 @@ import { existsSync } from 'node:fs';
 
 import { runLocalCli } from './local-cli.mjs';
 import { parsePublishArguments, publishUsage } from './publish-args.mjs';
+import { publishEachTarget } from './publish-retry.mjs';
 import { extensionRoot, isMainModule } from './vsix-targets.mjs';
 import { verifyVsix } from './vsix-verify.mjs';
 
@@ -20,15 +21,22 @@ async function main() {
   }
 
   await verifyInputs(options);
-  for (const file of options.files) {
-    console.log(`Publishing verified package ${file}...`);
-    runLocalCli(
-      '@vscode/vsce',
-      'vsce',
-      ['publish', '--packagePath', file, '--skip-duplicate', ...(azureCredential ? ['--azure-credential'] : [])],
-      { cwd: extensionRoot },
-    );
-  }
+  await publishEachTarget({
+    targets: options.targets,
+    files: options.files,
+    registry: 'Marketplace',
+    publishOne: (file) => {
+      const result = runLocalCli(
+        '@vscode/vsce',
+        'vsce',
+        ['publish', '--packagePath', file, '--skip-duplicate', ...(azureCredential ? ['--azure-credential'] : [])],
+        { cwd: extensionRoot, encoding: 'utf8', stdio: 'pipe' },
+      );
+      const output = `${result.stdout ?? ''}${result.stderr ?? ''}`;
+      process.stdout.write(output);
+      return /already published/i.test(output) ? 'skipped' : 'published';
+    },
+  });
 }
 
 async function verifyInputs(options) {

apps/vscode/test/publish-retry.test.ts

@@ -0,0 +1,92 @@
+import { describe, expect, it, vi } from 'vitest';
+
+// @ts-expect-error -- plain .mjs build script, no type declarations
+import { classifyError, publishEachTarget, withRetry } from '../scripts/publish-retry.mjs';
+
+const TARGETS = ['darwin-x64', 'darwin-arm64', 'linux-x64'];
+const FILES = TARGETS.map((target) => `/tmp/${target}.vsix`);
+
+// Backoff is real time; every retry test overrides it so the suite stays fast.
+const FAST = { backoffMs: [0, 0] };
+
+describe('classifyError', () => {
+  it('separates the three failure kinds that need different handling', () => {
+    // The exact string the Marketplace returned mid-publish on 2026-08-05.
+    expect(classifyError(new Error('Request timeout: /_apis/gallery/publishers/pythoughts'))).toBe('transient');
+    expect(classifyError(new Error('connect ECONNRESET 13.107.42.16:443'))).toBe('transient');
+    expect(classifyError(new Error('Response code 503 (Service Unavailable)'))).toBe('transient');
+
+    // The exact string the Entra credential path returned.
+    expect(classifyError(new Error('{"message":"The requested operation is not allowed."}'))).toBe('auth');
+    expect(classifyError(new Error('Response code 401 (Unauthorized)'))).toBe('auth');
+
+    expect(classifyError(new Error('Extension entrypoint(s) missing'))).toBe('fatal');
+  });
+});
+
+describe('withRetry', () => {
+  it('retries a transient failure and returns the eventual success', async () => {
+    const action = vi
+      .fn()
+      .mockRejectedValueOnce(new Error('Request timeout'))
+      .mockResolvedValueOnce('published');
+
+    await expect(withRetry(action, { label: 'test', ...FAST })).resolves.toBe('published');
+    expect(action).toHaveBeenCalledTimes(2);
+  });
+
+  it('gives up after the attempt budget and rethrows the last error', async () => {
+    const action = vi.fn().mockRejectedValue(new Error('Request timeout'));
+
+    await expect(withRetry(action, { label: 'test', attempts: 3, ...FAST })).rejects.toThrow('Request timeout');
+    expect(action).toHaveBeenCalledTimes(3);
+  });
+
+  it('does not retry a non-transient failure', async () => {
+    const action = vi.fn().mockRejectedValue(new Error('Response code 401 (Unauthorized)'));
+
+    await expect(withRetry(action, { label: 'test', ...FAST })).rejects.toThrow('401');
+    expect(action).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe('publishEachTarget', () => {
+  it('keeps publishing after one target fails, so a flake cannot strand the rest', async () => {
+    const publishOne = vi.fn(async (_file: string, target: string) => {
+      if (target === 'darwin-arm64') throw new Error('Extension rejected');
+      return 'published';
+    });
+
+    await expect(
+      publishEachTarget({ targets: TARGETS, files: FILES, registry: 'Marketplace', publishOne }),
+    ).rejects.toThrow('1 of 3 target(s) failed');
+
+    // The point of the change: linux-x64 is attempted even though darwin-arm64 died.
+    expect(publishOne.mock.calls.map((call) => call[1])).toEqual(TARGETS);
+  });
+
+  it('stops immediately on an auth failure instead of hammering every target', async () => {
+    const publishOne = vi.fn().mockRejectedValue(new Error('Response code 401 (Unauthorized)'));
+
+    await expect(
+      publishEachTarget({ targets: TARGETS, files: FILES, registry: 'Marketplace', publishOne }),
+    ).rejects.toThrow('3 of 3 target(s) failed');
+
+    expect(publishOne).toHaveBeenCalledTimes(1);
+  });
+
+  it('treats an already-published target as success, so a re-run completes', async () => {
+    const publishOne = vi.fn(async (_file: string, target: string) =>
+      target === 'darwin-x64' ? 'skipped' : 'published',
+    );
+
+    const result = await publishEachTarget({
+      targets: TARGETS,
+      files: FILES,
+      registry: 'Marketplace',
+      publishOne,
+    });
+
+    expect(result).toEqual({ published: ['darwin-arm64', 'linux-x64'], skipped: ['darwin-x64'] });
+  });
+});