@hypernewbie/phi-code 0.7.12 → 0.7.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +53 -0
- package/package.json +4 -1
package/README.md
ADDED
|
@@ -0,0 +1,53 @@
|
|
|
1
|
+
# `@hypernewbie/phi-code` — npm package notes
|
|
2
|
+
|
|
3
|
+
## npm v12 install-time security
|
|
4
|
+
|
|
5
|
+
As of npm v12 (https://github.blog/changelog/2026-07-08-npm-install-time-security-and-gat-bypass2fa-deprecation/),
|
|
6
|
+
**`postinstall` scripts no longer run by default**. This package's `postinstall`
|
|
7
|
+
(`scripts/install.js`) downloads the platform-native Go binary from GitHub releases
|
|
8
|
+
— without it, `phi` won't install.
|
|
9
|
+
|
|
10
|
+
### Project-scoped installs
|
|
11
|
+
This `package.json` ships an `allowScripts` entry that auto-approves the script:
|
|
12
|
+
|
|
13
|
+
```json
|
|
14
|
+
"allowScripts": { "@hypernewbie/phi-code": true }
|
|
15
|
+
```
|
|
16
|
+
|
|
17
|
+
So `npm install @hypernewbie/phi-code` (or `--save`) Just Works.
|
|
18
|
+
|
|
19
|
+
### Global installs (`npm install -g`)
|
|
20
|
+
There's no project `package.json` in global mode, so npm v12 can't read the
|
|
21
|
+
allowlist. End users on npm v12+ will need one of:
|
|
22
|
+
|
|
23
|
+
```sh
|
|
24
|
+
npm install -g @hypernewbie/phi-code --allow-scripts
|
|
25
|
+
```
|
|
26
|
+
|
|
27
|
+
or persist it once:
|
|
28
|
+
|
|
29
|
+
```sh
|
|
30
|
+
npm config set allow-scripts=@hypernewbie/phi-code --location=user
|
|
31
|
+
npm install -g @hypernewbie/phi-code
|
|
32
|
+
```
|
|
33
|
+
|
|
34
|
+
(or use `--ignore-scripts` and run `npx --yes @hypernewbie/phi-code` to fetch the
|
|
35
|
+
binary on demand.)
|
|
36
|
+
|
|
37
|
+
## Trusted publishing (OIDC)
|
|
38
|
+
|
|
39
|
+
The release workflow (`.github/workflows/release.yml`) is configured for
|
|
40
|
+
npm's trusted-publishing flow with OIDC: the `npm-publish` job has
|
|
41
|
+
`id-token: write` permission and calls `npm publish --provenance`. To complete
|
|
42
|
+
the migration:
|
|
43
|
+
|
|
44
|
+
1. On npmjs.com → package `@hypernewbie/phi-code` → **Publishing access** →
|
|
45
|
+
**Trusted Publishers** → **Add trusted publisher**:
|
|
46
|
+
- Owner: `hypernewbie`
|
|
47
|
+
- Repository: `phi`
|
|
48
|
+
- Workflow filename: `release.yml`
|
|
49
|
+
2. Remove the `NPM_TOKEN` repo secret once you've confirmed a tagged release
|
|
50
|
+
publishes successfully via OIDC alone (set `NODE_AUTH_TOKEN: ''` in the
|
|
51
|
+
workflow temporarily to test).
|
|
52
|
+
|
|
53
|
+
Until both are done, the workflow falls back to the legacy `NPM_TOKEN` secret.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@hypernewbie/phi-code",
|
|
3
|
-
"version": "0.7.
|
|
3
|
+
"version": "0.7.14",
|
|
4
4
|
"description": "Terminal multiplexer & control center for AI coding assistants",
|
|
5
5
|
"bin": {
|
|
6
6
|
"phi": "./bin/phi"
|
|
@@ -8,6 +8,9 @@
|
|
|
8
8
|
"scripts": {
|
|
9
9
|
"postinstall": "node scripts/install.js"
|
|
10
10
|
},
|
|
11
|
+
"allowScripts": {
|
|
12
|
+
"@hypernewbie/phi-code": true
|
|
13
|
+
},
|
|
11
14
|
"repository": {
|
|
12
15
|
"type": "git",
|
|
13
16
|
"url": "git+https://github.com/hypernewbie/phi.git"
|