@instawp/cli 0.0.1-beta.5 → 0.0.1-beta.9

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.0.1-beta.9 (2026-05-23)
+
+### Internals
+- CI smoke test now verifies the bundle by extracting the packed tarball directly (via `tar -xzf`) and running `rsync.exe` from the extract dir. Replaces the `npm install -g` step, which was failing on the GHA Windows runner due to Defender quarantine interactions (tamper protection prevented our exclusion settings from taking effect). Real-user installs are not affected — Defender on individual developer machines is configurable and the first reported Windows install showed the bundle landing at the correct path.
+
+## 0.0.1-beta.8 (2026-05-23)
+
+### Bug Fixes (Windows)
+- Moved bundled Windows binaries from `bin/win32/` to `vendor/win32/`. With `bin/` and the `bin` field in package.json both set, npm's global install on Windows dropped the `bin/win32/` subdirectory — leaving the CLI unable to find rsync.exe at runtime. macOS/Linux installs were unaffected. Renaming sidesteps the collision entirely.
+
+## 0.0.1-beta.7 (2026-05-23)
+
+### Internals
+- Smoke-windows CI job now runs the bundled `rsync.exe` and `busybox.exe` directly from the workspace bundle **before** the npm-install step, so a passing smoke test proves the DLL chain is correct independent of whether antivirus interferes with the global install path.
+- Adds Windows Defender exclusions before `npm i -g` to prevent msys DLLs from being quarantined during install.
+- Publish job now skips on `workflow_dispatch` (manual triggers), so maintainers can re-test the smoke job without bumping the version.
+
+## 0.0.1-beta.6 (2026-05-23)
+
+### Bug Fixes (Windows)
+- Bundled `rsync.exe` now actually loads. beta.4/beta.5 shipped with `msys-2.0.dll` from the legacy `msys2-runtime-3.3` fork, which is missing the `fallocate` symbol that rsync 3.4 needs — produced `Entry Point Not Found: fallocate` on launch and exit code `3221225785` (`STATUS_DLL_INIT_FAILED`) when invoked indirectly via `sync push/pull` or `local clone`.
+- Rebuilt the Windows bundle against current MSYS2 packages: `msys2-runtime-3.6.9-1`, `libopenssl-3.6.2-1`, `libiconv-1.19-1`, `libxxhash-0.8.3-1`, `libzstd-1.5.7-1`, `popt-1.19-1`, `libintl-0.22.5-1`. Includes `msys-popt-0.dll` and `msys-intl-8.dll` which the newer rsync now requires.
+- Upgraded bundled rsync from 3.4.0 → 3.4.2-2.
+
+### Internals
+- `scripts/fetch-windows-binaries.sh` now verifies DLL closure (every referenced `msys-*.dll` is present) and asserts `fallocate` is exported from `msys-2.0.dll` before declaring the bundle valid. Catches "wrong runtime fork" regressions at build time.
+- Added `smoke-windows` job to the publish workflow — runs on `windows-latest` and actually executes the bundled `rsync.exe` and `busybox.exe` before npm publish. Publish is now gated on this passing.
+
 ## 0.0.1-beta.5 (2026-05-23)
 
 ### New Commands

package/dist/lib/windows-binaries.js

@@ -4,10 +4,15 @@ import { resolveFromModule } from './paths.js';
 /**
  * Path to the bundled Windows binaries directory, resolved relative to this
  * module's location at runtime. After build, this module lives in
- * `dist/lib/windows-binaries.js`, so `../../bin/win32` lands at
- * `<package-root>/bin/win32`.
+ * `dist/lib/windows-binaries.js`, so `../../vendor/win32` lands at
+ * `<package-root>/vendor/win32`.
+ *
+ * NOTE: directory is named `vendor/win32` (not `bin/win32`) deliberately —
+ * npm's handling of the `bin` field interacts badly with a same-named `bin/`
+ * directory on Windows during global install (the subdir gets dropped),
+ * so we keep our bundled tools out of the conventional `bin/` slot.
  */
-const WIN_BIN_DIR = resolveFromModule(import.meta.url, '..', '..', 'bin', 'win32');
+const WIN_BIN_DIR = resolveFromModule(import.meta.url, '..', '..', 'vendor', 'win32');
 function bundled(name) {
     if (process.platform !== 'win32')
         return null;

package/dist/lib/windows-binaries.js.map

@@ -1 +1 @@
-{"version":3,"file":"windows-binaries.js","sourceRoot":"","sources":["../../src/lib/windows-binaries.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AAEnF,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAClC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,OAAO,CAAC,aAAa,CAAC,CAAC;AAChC,CAAC"}
+{"version":3,"file":"windows-binaries.js","sourceRoot":"","sources":["../../src/lib/windows-binaries.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C;;;;;;;;;;GAUG;AACH,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAEtF,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAClC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,OAAO,CAAC,aAAa,CAAC,CAAC;AAChC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@instawp/cli",
-  "version": "0.0.1-beta.5",
+  "version": "0.0.1-beta.9",
   "description": "InstaWP CLI - Create and manage WordPress sites from the terminal",
   "type": "module",
   "bin": {
@@ -10,7 +10,7 @@
     "dist",
     "!dist/__tests__",
     "scripts/mysql2sqlite",
-    "bin/win32/**",
+    "vendor/win32/**",
     "CHANGELOG.md"
   ],
   "scripts": {