git-span 1.0.148 → 1.1.1

package/bin/git-span.exe

@@ -2,5 +2,11 @@ git-span placeholder. scripts/postinstall.js replaces this file
 with the native binary for your platform. The name ends in .exe and the
 first line intentionally has NO "#!" shebang so npm/yarn/pnpm cmd-shim
 generates a direct-exec wrapper that runs on Windows; Unix ignores the
-.exe suffix and execs by mode bit. If you are seeing this text, the
-postinstall step did not run.
+.exe suffix and execs by mode bit. This file is tracked NON-executable
+(mode 644) on purpose: without a shebang, execvp()'s ENOEXEC fallback
+would otherwise re-exec it via /bin/sh, which parses this very sentence
+as a command line and recurses into itself indefinitely (a fork bomb —
+see the git-span-fork-bomb incident report). Non-executable makes execvp
+fail fast with EACCES instead. postinstall.js re-chmods to 0755 only
+after replacing this text with the real binary. If you are seeing this
+text, the postinstall step did not run.

package/man/git-span.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH git-span 1  "git-span 1.0.148"
+.TH git-span 1  "git-span 1.1.1"
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
 .SH NAME
@@ -136,7 +136,7 @@ Print this message or the help of the given subcommand(s)
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
 .SH VERSION
-v1.0.148
+v1.1.1
 .SH EXAMPLES
 Anchor a new span alongside a code change:
 .PP

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-span",
-  "version": "1.0.148",
+  "version": "1.1.1",
   "bin": "bin/git-span.exe",
   "man": [
     "man/git-span.1"
@@ -24,11 +24,11 @@
     "scripts/postinstall.js"
   ],
   "optionalDependencies": {
-    "git-span-darwin-arm64": "1.0.148",
-    "git-span-darwin-x64": "1.0.148",
-    "git-span-linux-arm64": "1.0.148",
-    "git-span-linux-x64": "1.0.148",
-    "git-span-win32-x64": "1.0.148"
+    "git-span-darwin-arm64": "1.1.1",
+    "git-span-darwin-x64": "1.1.1",
+    "git-span-linux-arm64": "1.1.1",
+    "git-span-linux-x64": "1.1.1",
+    "git-span-win32-x64": "1.1.1"
   },
   "repository": {
     "type": "git",

package/scripts/postinstall.js

@@ -71,9 +71,31 @@ function isInsideSourceTree() {
   return false;
 }
 
+function hasUsableBinaryInSourceTree() {
+  const platform = PLATFORM_MAP[process.platform];
+  const arch = ARCH_MAP[process.arch];
+  if (!platform || !arch) {
+    return false;
+  }
+  const sourceBinaryName = process.platform === 'win32' ? 'git-span.exe' : 'git-span';
+  try {
+    const packageDir = path.dirname(require.resolve(`git-span-${platform}-${arch}/package.json`));
+    return fs.existsSync(path.join(packageDir, 'bin', sourceBinaryName));
+  } catch {
+    return false;
+  }
+}
+
 function main() {
   if (isInsideSourceTree()) {
     console.log('git-span: postinstall skipped (running inside source tree).');
+    if (!hasUsableBinaryInSourceTree()) {
+      console.warn(
+        'git-span: warning: bin/git-span.exe is still the tracked placeholder and no ' +
+          'prebuilt platform binary was found either. `git span` will fail (not run) until ' +
+          'you run `yarn build:local` from packages/git-span.'
+      );
+    }
     return;
   }