@deleted-ai/deleted 0.1.349 → 0.1.353

package/README.md

@@ -16,10 +16,51 @@ npx @deleted-ai/deleted init my-box
 ```
 
 `--starter` runs a pre-signed bundle from `share/starter/` (`chat-tools` or
-`chat-echo`). Sources for the same assembly ship in
-`share/samples/chat-tools/` next to pre-built `prebuilt/*.wasm`; rebuilding them
-with `deleted pack build` (Rust + `wasm-tools` 1.235.x) reproduces the shipped
-binaries byte for byte.
+`chat-echo`).
+
+## Type `deleted` instead of `npx @deleted-ai/deleted`
+
+`npx` runs the CLI without installing it, but leaves nothing on your `PATH`.
+Optionally install once to get the short command used throughout the docs:
+
+```bash
+npm install -g @deleted-ai/deleted
+deleted --version
+```
+
+If that fails with `EACCES`, your Node keeps global packages in a root-owned
+directory. Keep using `npx @deleted-ai/deleted` — it needs no install and every
+command below works with it. If you would rather have the short command, point
+npm at a directory you own (`npm config set prefix ~/.npm-global`, then add
+`~/.npm-global/bin` to your `PATH`) or use a Node version manager. Installing
+with `sudo` would run this package's install script as root; nothing here needs
+that.
+
+Either form works everywhere below. The CLI prints next-step commands in
+whichever form you used, so you can always paste what it shows you.
+
+## Your own harness, still without Rust
+
+`deleted sample` copies a shipped sample into a directory with its pre-built
+guests already staged, so you can write and sign your own lock immediately:
+
+```bash
+deleted sample          # list what ships
+deleted sample echo
+cd echo
+deleted lock create chat-echo.recipe.yaml -o bundle
+deleted lock sign --dev-operator bundle
+deleted run --dev-operator bundle --entry /boxes/chat-cli -- "hello"
+# → completed: echo:hello
+```
+
+`deleted sample deepseek` is the same flow against a real model: export your own
+`DEEPSEEK_API_KEY`, point the recipe's `credential_id` at it, and sign. Signing
+is the operator approving that recipe's egress pin.
+
+Each sample also ships its guest sources. Rebuilding them with `deleted pack
+build` (Rust + `wasm-tools` 1.235.x) reproduces the staged binaries byte for
+byte — `deleted doctor` lists what that needs.
 
 On install (or first run), the package extracts the bundled release binary for
 your host — it ships one tarball per support-floor target and picks the match (or downloads from GitHub Releases when authenticated). No kernel source

package/bin/deleted.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { spawnSync } from 'node:child_process';
 import path from 'node:path';
+import fs from 'node:fs';
 import { ensureInstalled } from '../lib/install.js';
 import { nativeBinaryPath } from '../lib/paths.js';
 
@@ -12,10 +13,34 @@ try {
   process.exit(1);
 }
 
+// Next-step hints the binary prints must be commands this user can actually
+// run. A global install puts `deleted` on PATH; `npx` and a local dependency
+// install do not, so ask PATH rather than guessing from how we were launched.
+function shortCommandAvailable() {
+  const entries = (process.env.PATH ?? '')
+    .split(path.delimiter)
+    .filter(Boolean)
+    // npx and npm scripts prepend node_modules/.bin for the child process only.
+    // That shim is not on the user's own PATH, so it must not count here.
+    .filter((dir) => !dir.split(path.sep).includes('node_modules'));
+  return entries.some((dir) => {
+    try {
+      fs.accessSync(path.join(dir, 'deleted'), fs.constants.X_OK);
+      return true;
+    } catch {
+      return false;
+    }
+  });
+}
+
 const binary = nativeBinaryPath(cacheDir);
 const result = spawnSync(binary, process.argv.slice(2), {
   stdio: 'inherit',
-  env: process.env,
+  env: {
+    ...process.env,
+    // A selector, not display text: the binary owns the wording it prints.
+    DELETED_LAUNCHER: shortCommandAvailable() ? 'path' : 'npx',
+  },
 });
 
 if (result.error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deleted-ai/deleted",
-  "version": "0.1.349",
+  "version": "0.1.353",
   "description": "Deleted AI CLI wrapper — installs the native binary for this Linux host (arm64 or x64)",
   "license": "UNLICENSED",
   "type": "module",

package/release-manifest.json

@@ -1,15 +1,15 @@
 {
   "_comment": "Placeholder in git; scripts/publish-deleted-npm.sh stamps version, gitSha, and a tarballSha256 per target at publish. Install fails closed while a target's tarballSha256 is the zero sentinel.",
-  "version": "0.1.349",
-  "gitSha": "4847687",
+  "version": "0.1.353",
+  "gitSha": "c5de4a7",
   "repo": "cdlconsultants/deleted-ai",
   "releaseTagPrefix": "npm-v",
   "targets": {
     "linux-arm64": {
-      "tarballSha256": "6728c12fa9e3604bfeeb38b1da0a7ea4200322b4556b7db80cfabfc86e683bcf"
+      "tarballSha256": "570060c9e8a3e9d93e97e9129c2c36751623a216d83d2ec552d91d3fb87f524f"
     },
     "linux-x64": {
-      "tarballSha256": "7a7e287d756ff6a8694588eb8662075d9b304b94f278919b2ee4b326729b6620"
+      "tarballSha256": "01994d30d2ccbaec7873af8fe76ee2f7efcf07606ca0df6c1307fde1de9975e8"
     }
   }
 }