glasspane-harness 0.7.0 → 0.7.3

package/README.md

@@ -52,14 +52,14 @@ That is a measured claim, not a promise. The fork tracks upstream
 change:
 
 ```
-fork-diff vs v1.18.32: 6527/6687 byte-identical, 51 edited, 55 added, 54 deleted
+fork-diff vs v1.18.32: 4668/6713 byte-identical, 259 edited, 81 added, 1705 deleted
 ```
 
-Roughly 98% of the upstream tree is byte-for-byte upstream. The edits are concentrated in
-config/paths/branding, the `gp_*` tool surface, the kernel binding, the compaction hook,
-and the packaging scripts. The deleted files are upstream's own publish plumbing for
-channels this product does not use (ghcr images, AUR, a Homebrew tap, a hosted console
-account) — plus, in 0.4.0, the first-party account surface described below.
+Most of what upstream ships is still byte-for-byte upstream — 4,668 of its 6,632 files. The
+259 edits are concentrated in config/paths/branding, the `gp_*` tool surface, the kernel
+binding, the compaction hook, and the packaging scripts. The deleted files are upstream's own
+publish plumbing for channels this product does not use (ghcr images, AUR, a Homebrew tap, a
+hosted console account) — plus, in 0.4.0, the first-party account surface described below.
 
 What "additive" means in practice: if upstream ships a feature in a later release, this
 fork can take it, because the feature is still here to take.
@@ -113,6 +113,12 @@ curl -fsSL https://raw.githubusercontent.com/jingzhao-l/glasspane-harness/main/s
 
 Two commands are installed: **`glasspane-harness`** and the short alias **`gp-harness`**.
 
+Some package managers do not run install scripts by default, and the wrapper's
+`postinstall` is what places the real binary. Measured on 0.7.0: npm installs fine (npm 11+
+may print an `allow-scripts` notice on the first install; the command still works), while
+`bun add -g` skips that step and the command then prints its own remedy — run the one line
+it names. See [docs/install.md](docs/install.md#channels).
+
 **macOS only.** The engine, the permission model and the evidence pipeline exist only on
 macOS, so the npm distribution is macOS-only too: the package declares `os: darwin` and
 npm refuses the install elsewhere instead of handing you a binary that cannot run. There
@@ -183,8 +189,9 @@ Details: [`docs/evidence.md`](docs/evidence.md).
   customisation changed, and what deliberately stayed
 - [`docs/release.md`](docs/release.md) — cutting a release, and the npm trusted-publisher
   setup
-- [`docs/kernel-integration.md`](docs/kernel-integration.md) — the shared kernel, why it is
-  not on npm, and how much of the two-way integration exists today
+- [`docs/kernel-integration.md`](docs/kernel-integration.md) — the shared kernel, how it
+  reaches this fork as a pinned `iterate-kernel` dependency, and how much of the two-way
+  integration exists today
 - [`docs/troubleshooting.md`](docs/troubleshooting.md) — engine unreachable, permission
   denials, the `GP_E_*` codes
 - [`FORK.md`](FORK.md) / [`SYNCLOG.md`](SYNCLOG.md) — the fork's coordinates, discipline
@@ -202,7 +209,7 @@ bun run build --single      # product build: CLI + TUI + embedded web app
 ```
 
 The repo-side gates live in the GlassPane repository under `harness/` (hook-liveness,
-fork-diff, kernel-vendor, tool-surface, surface-semantics, product-surface,
+fork-diff, kernel-pin, tool-surface, surface-semantics, product-surface,
 brand-surface); their rationale, negative controls and known boundaries are documented in
 `harness/README.md`. Every customisation commit carries the `[gp]` prefix.
 

package/README.zh-CN.md

@@ -45,12 +45,12 @@ SDK 与 plugin API。为了塞下内核，没有任何功能被砍掉。
 `harness/tools/fork-diff.mjs` 每次改动都会把本树与那个 tag 逐文件对比：
 
 ```
-fork-diff vs v1.18.32: 6527/6687 byte-identical, 51 edited, 55 added, 54 deleted
+fork-diff vs v1.18.32: 4668/6713 byte-identical, 259 edited, 81 added, 1705 deleted
 ```
 
-上游树约 98% 逐字节保持上游原样。改动集中在 config/paths/品牌、`gp_*` 工具面、内核绑定、
-压缩钩子和打包脚本；删掉的是上游**自己的**发布管道（ghcr 镜像、AUR、Homebrew tap、
-托管 console 账号）——外加 0.4.0 里下面说的第一方账号面。
+上游发来的 6,632 个文件里 4,668 个仍逐字节保持上游原样。改动（259 个）集中在 config/paths/品牌、
+`gp_*` 工具面、内核绑定、压缩钩子和打包脚本；删掉的是上游**自己的**发布管道（ghcr 镜像、AUR、
+Homebrew tap、托管 console 账号）——外加 0.4.0 里下面说的第一方账号面。
 
 "加法"在实践中的含义：上游后续版本发布的功能，这个 fork 接得住——因为功能还在那里。
 
@@ -93,6 +93,11 @@ curl -fsSL https://raw.githubusercontent.com/jingzhao-l/glasspane-harness/main/s
 
 会装出两个命令：**`glasspane-harness`** 与短别名 **`gp-harness`**。
 
+有的包管理器默认不跑安装脚本，而把真二进制放到位的正是 wrapper 的 `postinstall`。
+0.7.0 实测：npm 这条路是好的（npm 11+ 首次安装会打一条 `allow-scripts` 提示，命令照样能跑）；
+`bun add -g` 会跳过那一步，命令于是打印它自己的补救——照它点名的一行执行即可。
+详见 [docs/install.md](docs/install.md)。
+
 **只支持 macOS。** 引擎、权限模型、证据流水线都只存在于 macOS，npm 分发随之收成
 macOS-only：包声明 `os: darwin`，非 macOS 上 npm 直接拒绝安装，而不是给你一个跑不了的
 二进制。**没有 Linux / Windows 构建，这是决定，不是遗漏。**
@@ -161,7 +166,7 @@ bun test --timeout 30000    # 固定点测试（在 packages/opencode 里跑）
 bun run build --single      # 产品构建：CLI + TUI + 内嵌 web 应用
 ```
 
-仓侧的闸住在 GlassPane 仓的 `harness/`（hook-liveness、fork-diff、kernel-vendor、
+仓侧的闸住在 GlassPane 仓的 `harness/`（hook-liveness、fork-diff、kernel-pin、
 tool-surface、surface-semantics、product-surface、brand-surface），理由、反向控制与已知边界
 写在 `harness/README.md`。我们每个定制提交都带 `[gp]` 前缀。
 

package/package.json

@@ -25,7 +25,7 @@
   "scripts": {
     "postinstall": "node ./postinstall.mjs"
   },
-  "version": "0.7.0",
+  "version": "0.7.3",
   "license": "MIT",
   "os": [
     "darwin"
@@ -44,7 +44,7 @@
   },
   "sideEffects": false,
   "optionalDependencies": {
-    "glasspane-harness-darwin-arm64": "0.7.0",
-    "glasspane-harness-darwin-x64": "0.7.0"
+    "glasspane-harness-darwin-arm64": "0.7.3",
+    "glasspane-harness-darwin-x64": "0.7.3"
   }
 }