pgserve 2.6.5 → 2.6.7

package/CHANGELOG.md

@@ -14,6 +14,69 @@ All notable changes to `pgserve` are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project adheres
 to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.6.7] - 2026-05-12
+
+**Stability-focused follow-up to v2.6.6** — closes the missing
+`autopg --version` handler that was causing every `Build *` platform
+job to fail the real-mode tarball smoke gate at v2.6.4 / v2.6.5 / v2.6.6.
+
+### Fixed
+
+- `bin/postgres-server.js` — handle `autopg --version` / `autopg -v` by
+  emitting `autopg <VERSION>\n` and exiting 0. The compiled bun binary
+  is what `tests/integration/tarball-smoke.sh --real` exec-checks; the
+  previous fall-through to `printHelp() + exit 1` surfaced as the
+  misleading "binary not executable" smoke failure. Version resolution
+  honors (in order): the bun compile-time `--define BUILD_VERSION=...`
+  injection from `scripts/build-binary.sh:104`, the
+  `AUTOPG_BUILD_VERSION` env override, and the sibling `package.json`
+  for dev runs.
+
+### What this unblocks
+
+- Real-mode smoke gate now passes → Build Tarballs job uploads
+  per-platform artifacts.
+- Sign + Attest workflow (workflow_run after Build Tarballs) actually
+  fires with non-empty inputs → cosign sign-blob, SLSA L3 provenance,
+  and GitHub Attestations API attestation per tarball succeed.
+- release-publish workflow (workflow_run after Sign + Attest) creates
+  the `v2.6.7` GitHub Release with the 12 signed assets (4 platforms
+  × tarball + bundle + intoto.jsonl) attached.
+
+### Same payload as v2.6.4 / v2.6.5 / v2.6.6
+
+The npm runtime surface is identical across the 2.6.4–2.6.7 cluster.
+Consumers like `@withone/cli` (`pgserve: ^2.2.3`) pick up the latest
+on next install regardless of which version they previously resolved.
+v2.6.7 is the version that ALSO ships the GH Release with signed
+tarballs — that's the only delta visible to operators.
+
+## [2.6.6] - 2026-05-12
+
+**Hot-fix follow-up to v2.6.5.** v2.6.5 published to npm but build-tarballs
+still failed with the same `scratch: unbound variable` error because
+v2.6.5's fix (initialize `local scratch=""` before the trap) wasn't
+sufficient — bash's RETURN trap appears to evaluate `$scratch` AFTER
+the function frame is popped, in the parent scope where the local
+is no longer visible.
+
+### Fixed
+
+- `scripts/fetch-postgres-bins.sh` (both `stage_from_pkg` and
+  `stage_from_url`) — make the RETURN trap unbound-safe regardless of
+  bash function-scope quirks by guarding the rm with
+  `[[ -n "${scratch:-}" ]] && rm -rf "$scratch"`. Defensive default-empty
+  expansion protects against:
+  - in-function fire (normal): scratch is a tempdir → rm runs
+  - out-of-function fire (bash 5.x scope quirk): scratch is empty → skipped
+  - pre-mktemp fire (early return): scratch is empty → skipped
+
+### Same payload as v2.6.5
+
+All v2.6.4 + v2.6.5 changes carry forward. v2.6.6 is purely the
+build-tarballs / GH Releases completion. The npm runtime surface is
+identical across v2.6.4/5/6.
+
 ## [2.6.5] - 2026-05-12
 
 **Hot-fix follow-up to v2.6.4.** v2.6.4 published to npm cleanly but the

package/bin/postgres-server.js

@@ -33,7 +33,47 @@ process.on('uncaughtException', (error) => {
 
 const args = process.argv.slice(2);
 
-if (args[0] === 'postmaster') {
+// `--version` / `-v` short-circuit — the compiled `autopg` binary
+// (bun --compile of this entry point) is the artifact that
+// `tests/integration/tarball-smoke.sh --real` exec-checks with
+// `autopg --version`. Without this branch the binary falls through to
+// `printHelp() + exit 1` and surfaces as the misleading
+// "binary not executable" smoke failure across every platform build.
+//
+// Version resolution order:
+//   1. BUILD_VERSION compile-time constant (bun --compile --define BUILD_VERSION="'<v>'"
+//      from scripts/build-binary.sh:104 — replaces the identifier in the
+//      compiled binary with the literal version string)
+//   2. AUTOPG_BUILD_VERSION env (operator override / dev runs)
+//   3. package.json sibling (dev runs from source via `bun bin/postgres-server.js`)
+//   4. literal 'unknown' (defensive)
+if (args[0] === '--version' || args[0] === '-v') {
+  let version = 'unknown';
+  // The compile-time --define replaces the bare identifier; wrap in
+  // typeof check so the source still parses + runs in non-compiled
+  // contexts where BUILD_VERSION is genuinely undefined.
+   
+  if (typeof BUILD_VERSION !== 'undefined' && BUILD_VERSION) {
+     
+    version = BUILD_VERSION;
+  } else if (typeof process.env.AUTOPG_BUILD_VERSION === 'string' && process.env.AUTOPG_BUILD_VERSION.length > 0) {
+    version = process.env.AUTOPG_BUILD_VERSION;
+  } else {
+    try {
+      const { readFileSync } = await import('node:fs');
+      const { fileURLToPath } = await import('node:url');
+      const { dirname, join } = await import('node:path');
+      const here = dirname(fileURLToPath(import.meta.url));
+      const pkg = JSON.parse(readFileSync(join(here, '..', 'package.json'), 'utf8'));
+      version = pkg.version;
+    } catch {
+      // fall through to 'unknown'
+    }
+  }
+  // tarball-smoke.sh asserts `autopg ${VERSION}` on stdout line 1.
+  process.stdout.write(`autopg ${version}\n`);
+  process.exit(0);
+} else if (args[0] === 'postmaster') {
   await runPostmasterSubcommand(args.slice(1));
 } else if (args[0] === 'serve') {
   // Alias `serve` → `postmaster` for symmetry with the v2.3 alias surface.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pgserve",
-  "version": "2.6.5",
+  "version": "2.6.7",
   "description": "Embedded PostgreSQL server with true concurrent connections - zero config, auto-provision databases",
   "main": "src/index.js",
   "type": "module",

package/scripts/fetch-postgres-bins.sh

@@ -117,7 +117,7 @@ stage_from_pkg() {
   # `scratch: unbound variable` and mask the real fetch error
   # (chatgpt-codex P2 review on PR #84).
   local scratch=""
-  trap 'rm -rf "$scratch"' RETURN
+  trap '[[ -n "${scratch:-}" ]] && rm -rf "$scratch"' RETURN
   scratch=$(mktemp -d) || return 1
 
   pushd "$scratch" >/dev/null
@@ -161,7 +161,7 @@ stage_from_url() {
   # masking the real fetch error (codex P2 review on PR #84 fixed this
   # for stage_from_pkg; stage_from_url was missed at the time).
   local scratch=""
-  trap 'rm -rf "$scratch"' RETURN
+  trap '[[ -n "${scratch:-}" ]] && rm -rf "$scratch"' RETURN
   scratch=$(mktemp -d) || return 1
 
   curl -fsSL "$url" -o "${scratch}/pg.tar.gz"