cargo-hauler 0.4.7 → 0.4.8

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.4.8
+
+### Patch Changes
+
+- 3ad6b7e: Declare no runtime `dependencies`: `npm install -g cargo-hauler` fetches one tarball and nothing else. 0.4.7 listed the build-time stack (`@agent-bundle/runtime` as a pkg.pr.new tarball, `bashjsast` as a `github:` ref, `effect`, `react`, `zod`, …) under `dependencies` even though every shipped file bundles what it uses, so npm 12's default `allow-remote=none` / `allow-git=none` refused the install (`EALLOWREMOTE` for the tarball, `EALLOWGIT` for the git ref). The whole stack now lives under `devDependencies`; the emitted packs and `dist/bin` executables are unchanged. (#82)
+
 ## 0.4.7
 
 ### Patch Changes

package/README.md

@@ -393,7 +393,10 @@ The npm package ships one plugin per host under `artifact/<host>` — the
 Claude Code plugin with its local marketplace, the Codex plugin, and the Cursor
 plugin with its `install.mjs` — plus three executables: `hauler` (the CLI),
 `cargo-hauler` (the routed commands), and `cargo-hauler-install`. Every pack
-also contains an `INSTALL.md` with the exact commands for that host.
+also contains an `INSTALL.md` with the exact commands for that host. The
+package declares no runtime dependencies — every library the packs and
+executables use is bundled into them — so `npm install` fetches this one
+tarball and nothing else.
 
 ### With the bundled installer