@cleocode/cleo 2026.4.91 → 2026.4.94

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cleocode/cleo",
-  "version": "2026.4.91",
+  "version": "2026.4.94",
   "description": "CLEO CLI — the assembled product consuming @cleocode/core",
   "type": "module",
   "main": "./dist/cli/index.js",
@@ -29,13 +29,14 @@
     "tree-sitter-ruby": "^0.23.1",
     "tree-sitter-rust": "0.23.1",
     "tree-sitter-typescript": "^0.23.2",
-    "@cleocode/caamp": "2026.4.91",
-    "@cleocode/cant": "2026.4.91",
-    "@cleocode/contracts": "2026.4.91",
-    "@cleocode/core": "2026.4.91",
-    "@cleocode/lafs": "2026.4.91",
-    "@cleocode/nexus": "2026.4.91",
-    "@cleocode/runtime": "2026.4.91"
+    "@cleocode/caamp": "2026.4.94",
+    "@cleocode/cant": "2026.4.94",
+    "@cleocode/contracts": "2026.4.94",
+    "@cleocode/core": "2026.4.94",
+    "@cleocode/lafs": "2026.4.94",
+    "@cleocode/nexus": "2026.4.94",
+    "@cleocode/playbooks": "2026.4.94",
+    "@cleocode/runtime": "2026.4.94"
   },
   "engines": {
     "node": ">=24.0.0"
@@ -49,6 +50,7 @@
     "migrations",
     "completions",
     "bin",
+    "scripts",
     "templates"
   ],
   "devDependencies": {
@@ -62,6 +64,7 @@
   },
   "scripts": {
     "build": "tsc",
+    "postbuild": "node scripts/assert-shebang.mjs",
     "typecheck": "tsc --noEmit",
     "test": "cd ../.. && vitest run packages/cleo/src",
     "postinstall": "node bin/postinstall.js"

package/scripts/assert-shebang.mjs

@@ -0,0 +1,63 @@
+/**
+ * Post-build assertion: every bin target declared in package.json MUST have
+ * `#!/usr/bin/env node` as its first line and MUST be owner-executable.
+ *
+ * Exits non-zero (failing the build) if any bin file is missing its shebang
+ * or lacks the executable bit. Also applies `chmod +x` so the assertion is
+ * idempotent on platforms where tsc does not set execute permissions.
+ *
+ * Run automatically via the `postbuild` npm lifecycle hook.
+ */
+
+import { readFileSync, chmodSync, statSync, existsSync } from "node:fs";
+import { resolve, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const PKG_ROOT = resolve(__dirname, "..");
+const SHEBANG = "#!/usr/bin/env node";
+
+/** @type {{ bin?: Record<string, string> }} */
+const pkg = JSON.parse(readFileSync(resolve(PKG_ROOT, "package.json"), "utf-8"));
+
+const binEntries = Object.entries(pkg.bin ?? {});
+
+if (binEntries.length === 0) {
+  console.log("assert-shebang: no bin targets declared — nothing to check.");
+  process.exit(0);
+}
+
+let failed = false;
+
+for (const [name, relPath] of binEntries) {
+  const absPath = resolve(PKG_ROOT, relPath);
+
+  if (!existsSync(absPath)) {
+    console.error(`assert-shebang: MISSING bin target '${name}' → ${absPath}`);
+    failed = true;
+    continue;
+  }
+
+  const content = readFileSync(absPath, "utf-8");
+  const firstLine = content.split("\n")[0];
+
+  if (firstLine !== SHEBANG) {
+    console.error(
+      `assert-shebang: FAIL '${name}' (${relPath}) — first line is: ${JSON.stringify(firstLine)}\n` +
+        `  Expected: ${JSON.stringify(SHEBANG)}`
+    );
+    failed = true;
+  } else {
+    // Ensure owner-executable bit is set (0o100 = owner execute)
+    const stat = statSync(absPath);
+    if ((stat.mode & 0o100) === 0) {
+      chmodSync(absPath, stat.mode | 0o111);
+      console.log(`assert-shebang: chmod +x applied to '${name}' (${relPath})`);
+    }
+    console.log(`assert-shebang: OK '${name}' (${relPath})`);
+  }
+}
+
+if (failed) {
+  process.exit(1);
+}