oathbound 0.11.0 → 0.11.1

package/cli.ts

@@ -24,9 +24,9 @@ import { push } from './push';
 // Re-exports for tests
 export { stripJsoncComments, writeOathboundConfig, mergeClaudeSettings, type MergeResult } from './config';
 export { isNewer } from './update';
-export { installDevDependency, type InstallResult, setup, addPrepareScript, type PrepareResult };
+export { installDevDependency, type InstallResult, setup, addPrepareScript, type PrepareResult, addTrustedDependency, type TrustedDepResult };
 
-const VERSION = '0.11.0';
+const VERSION = '0.11.1';
 
 // --- Supabase ---
 const SUPABASE_URL = 'https://mjnfqagwuewhgwbtrdgs.supabase.co';
@@ -106,6 +106,27 @@ function setup(): void {
   }
 }
 
+type TrustedDepResult = 'added' | 'skipped';
+
+function addTrustedDependency(): TrustedDepResult {
+  const pkgPath = join(process.cwd(), 'package.json');
+  if (!existsSync(pkgPath)) return 'skipped';
+
+  let pkg: Record<string, unknown>;
+  try {
+    pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+  } catch {
+    return 'skipped';
+  }
+
+  const trusted = Array.isArray(pkg.trustedDependencies) ? pkg.trustedDependencies as string[] : [];
+  if (trusted.includes('oathbound')) return 'skipped';
+
+  pkg.trustedDependencies = [...trusted, 'oathbound'];
+  writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n');
+  return 'added';
+}
+
 type PrepareResult = 'added' | 'appended' | 'skipped';
 
 function addPrepareScript(): PrepareResult {
@@ -194,6 +215,15 @@ async function init(): Promise<void> {
       process.exit(1);
   }
 
+  // For bun/pnpm: add trustedDependencies so postinstall runs
+  const pm = detectPackageManager();
+  if (pm === 'bun' || pm === 'pnpm') {
+    const trustResult = addTrustedDependency();
+    if (trustResult === 'added') {
+      process.stderr.write(`${GREEN} ✓ Added oathbound to trustedDependencies (required by ${pm})${RESET}\n`);
+    }
+  }
+
   // Add prepare script to package.json
   const prepareResult = addPrepareScript();
   if (prepareResult === 'added' || prepareResult === 'appended') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oathbound",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "description": "Install verified Claude Code skills from the Oath Bound registry",
   "license": "BUSL-1.1",
   "author": "Josh Anderson",