@lpm-registry/cli 0.76.0-nightly.20260826.156.390fd37 → 0.76.5

package/README.md

@@ -6,15 +6,46 @@ Fast, secure, all-in-one package manager written in Rust.
 npm install -g @lpm-registry/cli --allow-scripts=@lpm-registry/cli
 ```
 
-This package is the npm gateway for the native LPM CLI. It installs a small
-JavaScript launcher plus the matching platform package, such as
+This package is the npm gateway for the native LPM CLI. It installs the
+matching platform package, such as
 `@lpm-registry/cli-darwin-arm64`, `@lpm-registry/cli-linux-x64`, or
-`@lpm-registry/cli-linux-x64-musl`. A tiny
-`postinstall` verifier checks the native binary and wires the global command to
-it where the platform allows that.
+`@lpm-registry/cli-linux-x64-musl`. The `postinstall` script validates the native
+program and connects `lpm` and `lpx` directly to it.
 
-The JavaScript launcher does not implement package-manager behavior. All CLI
-commands run in the native Rust binary.
+On macOS, the platform package contains a signed `LPM CLI.app`. The direct
+commands run `LPM CLI.app/Contents/MacOS/lpm-rs`. They do not start Node or a
+shell. LPM CLI runs when LPM Vault is not installed or not open.
+
+The package keeps a small JavaScript launcher for installs that disable
+scripts. This launcher only finds and starts the native program. It does not
+implement package-manager behavior.
+
+## Installer behavior
+
+These tools install the Rust client. They are not `lpm self-update` modes.
+
+| Installer | Default command behavior | Install script option |
+| --- | --- | --- |
+| npm 11 | Direct native command | No extra option |
+| npm 12 | JavaScript launcher | Use `--allow-scripts=@lpm-registry/cli` |
+| Yarn | Direct native command | No extra option |
+| Bun | JavaScript launcher | Use `--trust` |
+| pnpm | JavaScript launcher | Use `--allow-build=@lpm-registry/cli` to validate the native program |
+| Volta | Volta shim, then the native command | No extra option |
+
+The JavaScript launcher only starts the Rust program. All LPM functions remain
+available. The launcher adds one process start before the Rust program starts.
+
+Use these commands for the native optimization on npm, Bun, or pnpm:
+
+```bash
+npm install -g @lpm-registry/cli --allow-scripts=@lpm-registry/cli
+bun add -g @lpm-registry/cli --trust
+pnpm add -g @lpm-registry/cli --allow-build=@lpm-registry/cli
+```
+
+On macOS, pnpm keeps its launcher after it validates the signed app. This
+preserves the links that pnpm manages.
 
 Source for this npm package lives in `lpm-dev/rust-client/npm/cli`.
 
@@ -24,12 +55,21 @@ Source for this npm package lives in `lpm-dev/rust-client/npm/cli`.
 lpm self-update
 ```
 
-When LPM was installed through npm, self-update runs:
+`lpm self-update` detects npm, pnpm, Bun, Yarn, and Volta installations. It
+runs the update command for the detected installer.
+
+For an npm installation, self-update runs:
 
 ```bash
 npm install -g @lpm-registry/cli@<version>
 ```
 
+On macOS, this install keeps the complete signed app bundle. If npm permits the
+installer script, the script restores the direct command links.
+
+If the detected installer blocks scripts, the update still completes. The
+JavaScript launcher remains active until you use the applicable trust option.
+
 ## Troubleshooting
 
 If your package manager was configured to omit optional dependencies, reinstall
@@ -39,8 +79,9 @@ with optional dependencies enabled:
 npm install -g @lpm-registry/cli
 ```
 
-If your npm policy blocks install scripts, allow LPM's installer script so npm
-can validate the native binary during installation:
+If your npm policy blocks install scripts, LPM uses the JavaScript fallback.
+Allow the installer script to validate the native program and create direct
+commands:
 
 ```bash
 npm install -g @lpm-registry/cli --allow-scripts=@lpm-registry/cli

package/bin/native.js

@@ -9,13 +9,13 @@ const require = createRequire(import.meta.url);
 export const PLATFORMS = Object.freeze({
   "darwin-arm64": {
     pkg: "@lpm-registry/cli-darwin-arm64",
-    lpm: "lpm",
-    lpx: "lpx",
+    lpm: "LPM CLI.app/Contents/MacOS/lpm-rs",
+    lpx: "LPM CLI.app/Contents/MacOS/lpm-rs",
   },
   "darwin-x64": {
     pkg: "@lpm-registry/cli-darwin-x64",
-    lpm: "lpm",
-    lpx: "lpx",
+    lpm: "LPM CLI.app/Contents/MacOS/lpm-rs",
+    lpx: "LPM CLI.app/Contents/MacOS/lpm-rs",
   },
   "linux-arm64": {
     pkg: "@lpm-registry/cli-linux-arm64",
@@ -114,7 +114,7 @@ export function resolveNativeBinary(options = {}) {
   return {
     path: binaryPath,
     source: spec.pkg,
-    argsPrefix: [],
+    argsPrefix: command === "lpx" && spec.lpm === spec.lpx ? ["dlx"] : [],
   };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lpm-registry/cli",
-  "version": "0.76.0-nightly.20260826.156.390fd37",
+  "version": "0.76.5",
   "description": "LPM CLI native binary installer for npm",
   "repository": {
     "type": "git",
@@ -26,12 +26,12 @@
     "README.md"
   ],
   "optionalDependencies": {
-    "@lpm-registry/cli-darwin-arm64": "0.76.0-nightly.20260826.156.390fd37",
-    "@lpm-registry/cli-darwin-x64": "0.76.0-nightly.20260826.156.390fd37",
-    "@lpm-registry/cli-linux-arm64": "0.76.0-nightly.20260826.156.390fd37",
-    "@lpm-registry/cli-linux-x64": "0.76.0-nightly.20260826.156.390fd37",
-    "@lpm-registry/cli-linux-x64-musl": "0.76.0-nightly.20260826.156.390fd37",
-    "@lpm-registry/cli-win32-x64": "0.76.0-nightly.20260826.156.390fd37"
+    "@lpm-registry/cli-darwin-arm64": "0.76.5",
+    "@lpm-registry/cli-darwin-x64": "0.76.5",
+    "@lpm-registry/cli-linux-arm64": "0.76.5",
+    "@lpm-registry/cli-linux-x64": "0.76.5",
+    "@lpm-registry/cli-linux-x64-musl": "0.76.5",
+    "@lpm-registry/cli-win32-x64": "0.76.5"
   },
   "type": "module",
   "engines": {

package/scripts/install-binary.js

@@ -73,6 +73,8 @@ export function installNativeBinaries(options = {}) {
     validateTimeoutMs,
   });
 
+  const retainLauncherShims = shouldRetainLauncherShims({ platform, env });
+
   const optimized = [];
   for (const command of commands) {
     const native =
@@ -87,12 +89,14 @@ export function installNativeBinaries(options = {}) {
             requireFn,
           });
     const target = optimizedTargetPath(wrapperRoot, platform, command);
-    const action = stageOptimizedBinary({
-      source: native.path,
-      target,
-      platform,
-      fsModule,
-    });
+    const action = retainLauncherShims
+      ? "launcher"
+      : stageOptimizedBinary({
+          source: native.path,
+          target,
+          platform,
+          fsModule,
+        });
     optimized.push({
       command,
       source: native.path,
@@ -101,10 +105,22 @@ export function installNativeBinaries(options = {}) {
     });
   }
 
-  logFn(`[lpm] Installed native binary from ${spec.pkg}`);
+  if (retainLauncherShims) {
+    logFn(
+      `[lpm] Validated native binary from ${spec.pkg}; retaining pnpm-compatible launchers.`,
+    );
+  } else {
+    logFn(`[lpm] Installed native binary from ${spec.pkg}`);
+  }
   return { status: "installed", platform: key, package: spec.pkg, optimized };
 }
 
+export function shouldRetainLauncherShims({ platform, env = process.env } = {}) {
+  if (platform !== "darwin") return false;
+  const userAgent = env.npm_config_user_agent ?? env.NPM_CONFIG_USER_AGENT ?? "";
+  return /^pnpm\//i.test(userAgent.trim());
+}
+
 export function isSudoTransition({ geteuid, env = process.env } = {}) {
   if (typeof geteuid !== "function" || geteuid() !== 0) {
     return false;
@@ -178,6 +194,10 @@ export function validateNativeBinary(
 
 export function stageOptimizedBinary({ source, target, platform, fsModule = fs }) {
   fsModule.mkdirSync(path.dirname(target), { recursive: true });
+  if (platform === "darwin") {
+    atomicSymlink(source, target, fsModule);
+    return "symlink";
+  }
   if (platform === "win32") {
     atomicCopy(source, target, fsModule);
     return "copy";
@@ -192,6 +212,13 @@ export function stageOptimizedBinary({ source, target, platform, fsModule = fs }
   }
 }
 
+function atomicSymlink(source, target, fsModule) {
+  replaceWithTemp(target, fsModule, temp => {
+    const relativeSource = path.relative(path.dirname(target), source);
+    fsModule.symlinkSync(relativeSource, temp, "file");
+  });
+}
+
 function optimizedTargetPath(wrapperRoot, platform, command) {
   const filename = platform === "win32" ? `${command}.exe` : command;
   return path.join(wrapperRoot, "bin", filename);