instar 1.2.9 → 1.2.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli.js +0 -0
- package/package.json +2 -2
- package/src/data/builtin-manifest.json +2 -2
- package/upgrades/1.2.10.md +59 -0
package/dist/cli.js
CHANGED
|
File without changes
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "instar",
|
|
3
|
-
"version": "1.2.
|
|
3
|
+
"version": "1.2.10",
|
|
4
4
|
"description": "Persistent autonomy infrastructure for AI agents",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "dist/index.js",
|
|
@@ -16,7 +16,7 @@
|
|
|
16
16
|
},
|
|
17
17
|
"scripts": {
|
|
18
18
|
"generate:manifest": "node scripts/generate-builtin-manifest.cjs",
|
|
19
|
-
"build": "node scripts/generate-builtin-manifest.cjs && tsc && node scripts/sign-instar-lockfile.mjs",
|
|
19
|
+
"build": "node scripts/generate-builtin-manifest.cjs && tsc && chmod 0755 dist/cli.js && node scripts/sign-instar-lockfile.mjs",
|
|
20
20
|
"dev": "tsc --watch",
|
|
21
21
|
"test": "vitest run",
|
|
22
22
|
"test:push": "vitest run --config vitest.push.config.ts",
|
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"$schema": "./builtin-manifest.schema.json",
|
|
3
3
|
"schemaVersion": 1,
|
|
4
|
-
"generatedAt": "2026-05-
|
|
5
|
-
"instarVersion": "1.2.
|
|
4
|
+
"generatedAt": "2026-05-21T19:10:49.449Z",
|
|
5
|
+
"instarVersion": "1.2.10",
|
|
6
6
|
"entryCount": 191,
|
|
7
7
|
"entries": {
|
|
8
8
|
"hook:session-start": {
|
|
@@ -0,0 +1,59 @@
|
|
|
1
|
+
# Upgrade Guide — vNEXT
|
|
2
|
+
|
|
3
|
+
<!-- bump: patch -->
|
|
4
|
+
<!-- patch = bug fix with regression test, no new surface -->
|
|
5
|
+
|
|
6
|
+
## What Changed
|
|
7
|
+
|
|
8
|
+
**fix(packaging): `dist/cli.js` now ships with the executable bit set in the published npm tarball.**
|
|
9
|
+
|
|
10
|
+
`tsc` writes compiled output at mode 0644 by default. The build script previously did not chmod the bin target, so every published instar tarball from 1.0.13 onward shipped `dist/cli.js` at `-rw-r--r--`.
|
|
11
|
+
|
|
12
|
+
Normally `npm install` papers over this by chmodding bin targets to 0755 at link time, so fresh installs work. But `npx`'s package cache reuses the bin symlink across version upgrades and skips re-chmodding the underlying target file on subsequent installs — so users who had previously run `npx instar` could hit `sh: .../instar: Permission denied` after a version bump, even though the symlink itself looked correct. The mode on the target file stayed at 0644 from a previous install while new file bytes were written in place.
|
|
13
|
+
|
|
14
|
+
After this release:
|
|
15
|
+
- `package.json` `build` script ends with `chmod 0755 dist/cli.js`, so the file is mode 0755 before `npm publish` packs it.
|
|
16
|
+
- The tarball entry for `dist/cli.js` ships at `-rwxr-xr-x` regardless of npm's install-time behavior.
|
|
17
|
+
- `tests/unit/package-completeness.test.ts` adds a regression test that packs a real tarball, lists it with `tar -tvf`, and asserts every entry referenced by `package.json` `bin` has the exec bit. The test fails if the chmod step is removed.
|
|
18
|
+
|
|
19
|
+
## What to Tell Your User
|
|
20
|
+
|
|
21
|
+
No user action needed. If you had previously seen the npx instar command fail with a permission-denied error after a version bump, that path is now fixed — the next published version will run cleanly. If a stale copy is still cached, clearing the npx cache picks up the corrected bytes.
|
|
22
|
+
|
|
23
|
+
## Summary of New Capabilities
|
|
24
|
+
|
|
25
|
+
| Capability | How to Use |
|
|
26
|
+
|-----------|-----------|
|
|
27
|
+
| npx instar works across version bumps even when npm's bin chmod is skipped | Automatic — published tarball now ships dist/cli.js with the exec bit |
|
|
28
|
+
|
|
29
|
+
## Evidence
|
|
30
|
+
|
|
31
|
+
**Reproduction (before the fix):**
|
|
32
|
+
|
|
33
|
+
```
|
|
34
|
+
$ npm pack
|
|
35
|
+
$ tar -tzvf instar-*.tgz package/dist/cli.js
|
|
36
|
+
-rw-r--r-- 0 0 0 90101 Oct 26 1985 package/dist/cli.js
|
|
37
|
+
```
|
|
38
|
+
|
|
39
|
+
The tarball entry has no `x` in the mode — confirms the published 1.2.7 (and every earlier version back to 1.0.13) shipped without the exec bit.
|
|
40
|
+
|
|
41
|
+
**After the fix:**
|
|
42
|
+
|
|
43
|
+
```
|
|
44
|
+
$ npm run build
|
|
45
|
+
$ npm pack
|
|
46
|
+
$ tar -tzvf instar-*.tgz package/dist/cli.js
|
|
47
|
+
-rwxr-xr-x 0 0 0 90101 Oct 26 1985 package/dist/cli.js
|
|
48
|
+
```
|
|
49
|
+
|
|
50
|
+
**Regression test:**
|
|
51
|
+
|
|
52
|
+
`tests/unit/package-completeness.test.ts > all package.json bin files ship with the executable bit set` — runs `npm pack` into a temp dir, inspects the tarball with `tar -tvf`, asserts each bin entry has `x` in its mode string. Verified to fail when the `chmod 0755` step is removed from the build script — output: `dist/cli.js: ships at "-rw-r--r--" (no exec bit)`.
|
|
53
|
+
|
|
54
|
+
**Original failure observed in the field:**
|
|
55
|
+
|
|
56
|
+
```
|
|
57
|
+
$ npx instar@latest
|
|
58
|
+
sh: /Users/.../node_modules/.bin/instar: Permission denied
|
|
59
|
+
```
|