glasspane-harness 0.7.6 → 0.7.8

package/README.md

@@ -116,8 +116,9 @@ Two commands are installed: **`glasspane-harness`** and the short alias **`gp-ha
 Some package managers do not run install scripts by default, and the wrapper's
 `postinstall` is what places the real binary. Measured on 0.7.0: npm installs fine (npm 11+
 may print an `allow-scripts` notice on the first install; the command still works), while
-`bun add -g` skips that step and the command then prints its own remedy — run the one line
-it names. See [docs/install.md](docs/install.md#channels).
+`bun add -g` skips that step and the command then prints its own remedy — from 0.7.7 that
+line names this install's own directory, so running it verbatim is the fix. See
+[docs/install.md](docs/install.md#channels).
 
 **macOS only.** The engine, the permission model and the evidence pipeline exist only on
 macOS, so the npm distribution is macOS-only too: the package declares `os: darwin` and

package/README.zh-CN.md

@@ -95,7 +95,8 @@ curl -fsSL https://raw.githubusercontent.com/jingzhao-l/glasspane-harness/main/s
 
 有的包管理器默认不跑安装脚本，而把真二进制放到位的正是 wrapper 的 `postinstall`。
 0.7.0 实测：npm 这条路是好的（npm 11+ 首次安装会打一条 `allow-scripts` 提示，命令照样能跑）；
-`bun add -g` 会跳过那一步，命令于是打印它自己的补救——照它点名的一行执行即可。
+`bun add -g` 会跳过那一步，命令于是打印它自己的补救——0.7.7 起那一句点名的是**这一份安装自己
+的目录**，所以照抄执行就是修法。
 详见 [docs/install.md](docs/install.md)。
 
 **只支持 macOS。** 引擎、权限模型、证据流水线都只存在于 macOS，npm 分发随之收成

package/bin/glasspane-harness.exe

@@ -1,10 +1,31 @@
+#!/bin/sh
+self=$0
+i=0
+while [ -L "$self" ] && [ $i -lt 8 ]; do
+  t=$(readlink "$self")
+  case $t in
+    /*) self=$t ;;
+    *) self=$(CDPATH= cd -P -- "$(dirname -- "$self")" && printf '%s/%s' "$PWD" "$t") ;;
+  esac
+  i=$((i + 1))
+done
+here=$(CDPATH= cd -P -- "$(dirname -- "$self")/.." 2>/dev/null && pwd)
 echo "Error: glasspane-harness's postinstall script was not run." >&2
 echo "" >&2
-echo "This occurs when using --ignore-scripts during installation, or when using a" >&2
-echo "package manager like pnpm that does not run postinstall scripts by default." >&2
+echo "The command on your PATH is still the placeholder the tarball ships, not the" >&2
+echo "binary. Managers leave it in place when they gate lifecycle scripts: bun blocks a" >&2
+echo "dependency's scripts until you trust it, npm skips them under --ignore-scripts," >&2
+echo "and some managers skip them by default." >&2
 echo "" >&2
-echo "To fix this, run the postinstall script manually:" >&2
-echo "  cd node_modules/glasspane-harness && node postinstall.mjs" >&2
+if [ -n "$here" ]; then
+  echo "Run this install's own postinstall step:" >&2
+  echo "  cd \"$here\" && node postinstall.mjs" >&2
+  echo "" >&2
+fi
+echo "Or let the package manager run it:" >&2
+echo '  cd "$(npm root -g)/glasspane-harness" && node postinstall.mjs   # npm global install' >&2
+echo "  bun pm trust glasspane-harness                        # in the project you installed into" >&2
 echo "" >&2
-echo "Or reinstall glasspane-harness without the --ignore-scripts flag." >&2
+echo "Either way the check afterwards is the same, and only a version number means it" >&2
+echo "worked: glasspane-harness --version" >&2
 exit 1

package/package.json

@@ -25,7 +25,7 @@
   "scripts": {
     "postinstall": "node ./postinstall.mjs"
   },
-  "version": "0.7.6",
+  "version": "0.7.8",
   "license": "MIT",
   "os": [
     "darwin"
@@ -44,7 +44,7 @@
   },
   "sideEffects": false,
   "optionalDependencies": {
-    "glasspane-harness-darwin-arm64": "0.7.6",
-    "glasspane-harness-darwin-x64": "0.7.6"
+    "glasspane-harness-darwin-arm64": "0.7.8",
+    "glasspane-harness-darwin-x64": "0.7.8"
   }
 }

package/postinstall.mjs

@@ -28,6 +28,9 @@ const arch = archMap[os.arch()] ?? os.arch()
 // keeps these constants in step with it (this file ships inside the npm wrapper).
 const base = `glasspane-harness-${platform}-${arch}`
 const sourceBinary = platform === "windows" ? "glasspane-harness.exe" : "glasspane-harness"
+// Same rule as the names above: the value lives in product.json (`npm.registry`), and
+// harness/tools/product-surface.mjs is what keeps this literal from drifting away from it.
+const REGISTRY = "https://registry.npmjs.org"
 const targetBinary = path.join(__dirname, "bin", "glasspane-harness.exe")
 
 function supportsAvx2() {
@@ -133,7 +136,23 @@ function installPackage(name) {
   try {
     const result = childProcess.spawnSync(
       "npm",
-      ["install", "--ignore-scripts", "--no-save", "--loglevel=error", "--prefix", temp, `${name}@${version}`],
+      [
+        "install",
+        "--ignore-scripts",
+        "--no-save",
+        "--loglevel=error",
+        // The registry has to be named. npm resolves `npm_config_registry` (which npm exports
+        // into lifecycle scripts), `NPM_CONFIG_REGISTRY`, `~/.npmrc` and a project `.npmrc`, so
+        // without this the bytes fetched here — then chmod 0755 and executed — come from
+        // whatever mirror the ambient config names, and the package's integrity hash is
+        // self-attested by that same mirror. `script/verify-published.ts` passes `--registry`
+        // for exactly this reason; the install path is the one that runs on a user's machine.
+        "--registry",
+        REGISTRY,
+        "--prefix",
+        temp,
+        `${name}@${version}`,
+      ],
       { stdio: "inherit", windowsHide: true },
     )
     if (result.status !== 0) return