swytchcode 2.20.15 → 2.20.16

package/README.md

@@ -40,6 +40,10 @@ npm install -g swytchcode
 
 The correct binary for your platform (macOS, Linux, Windows - x64 and arm64) is selected automatically.
 
+> **Security & Execution Policy Note (Windows):** The npm package uses a `postinstall` script to delete the `.ps1` wrapper files generated by npm. This forces PowerShell to fall back to the `.cmd` wrapper, bypassing the default `Restricted` execution policy so the CLI runs out of the box.
+> - **Scanners:** Automated supply-chain scanners (e.g. Socket.dev) may flag this postinstall script because it deletes files outside the package directory. This is benign and limited only to removing the npm-generated shims.
+> - **--ignore-scripts:** If you install with `npm install -g swytchcode --ignore-scripts` (or have it set in your config), the postinstall cleanup won't run. You can run the CLI by explicitly invoking `swytchcode.cmd` (or `swy.cmd`). To use the unqualified `swytchcode` command in PowerShell, you must explicitly opt in by running `Set-ExecutionPolicy RemoteSigned -Scope CurrentUser`.
+
 ## Usage
 
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "swytchcode",
-  "version": "2.20.15",
+  "version": "2.20.16",
   "repository": {
     "type": "git",
     "url": "git+https://gitlab.com/swytchcode/cli.git"
@@ -25,14 +25,18 @@
   },
   "files": [
     "bin/swytchcode.js",
+    "scripts/postinstall.js",
     "README.md"
   ],
+  "scripts": {
+    "postinstall": "node ./scripts/postinstall.js"
+  },
   "optionalDependencies": {
-    "swytchcode-cli-darwin-arm64": "2.20.15",
-    "swytchcode-cli-darwin-x64": "2.20.15",
-    "swytchcode-cli-linux-arm64": "2.20.15",
-    "swytchcode-cli-linux-x64": "2.20.15",
-    "swytchcode-cli-win32-arm64": "2.20.15",
-    "swytchcode-cli-win32-x64": "2.20.15"
+    "swytchcode-cli-darwin-arm64": "2.20.16",
+    "swytchcode-cli-darwin-x64": "2.20.16",
+    "swytchcode-cli-linux-arm64": "2.20.16",
+    "swytchcode-cli-linux-x64": "2.20.16",
+    "swytchcode-cli-win32-arm64": "2.20.16",
+    "swytchcode-cli-win32-x64": "2.20.16"
   }
 }

package/scripts/postinstall.js

@@ -0,0 +1,43 @@
+const fs = require('fs');
+const path = require('path');
+const { execSync } = require('child_process');
+
+function cleanPs1Shims() {
+  // Only run on Windows
+  if (process.platform !== 'win32') {
+    return;
+  }
+
+  // Only run for global installs
+  if (process.env.npm_config_global !== 'true') {
+    return;
+  }
+
+  // Get the global npm prefix (which is where the shim files are placed on Windows)
+  let prefix = process.env.npm_config_prefix;
+  if (!prefix) {
+    try {
+      prefix = execSync('npm prefix -g', { encoding: 'utf8' }).trim();
+    } catch (_) {}
+  }
+  
+  if (!prefix) return;
+
+  const shims = ['swytchcode.ps1', 'swy.ps1'];
+  
+  for (const shim of shims) {
+    try {
+      const shimPath = path.join(prefix, shim);
+      if (fs.existsSync(shimPath)) {
+        fs.unlinkSync(shimPath);
+        // We delete the .ps1 files so that PowerShell falls back to executing
+        // the .cmd files instead. The .cmd files are not subject to PowerShell's
+        // Execution Policy (which defaults to Restricted and blocks .ps1 files).
+      }
+    } catch (_) {
+      // Best-effort removal. Silently continue if something goes wrong (e.g. file lock, permissions)
+    }
+  }
+}
+
+cleanPs1Shims();