mirror of
https://github.com/hanzoai/cli.git
synced 2026-10-30 15:00:27 +00:00
zeekay
7cdb9907bd
The CLI was GitHub-releases only. @hanzo/dev and @hanzo/mcp install with npm and this did not, so "install the Hanzo tools" meant two different motions and the sandbox image had to special-case one of them. A DOWNLOADER, not five platform packages. @hanzo/dev uses optionalDependencies; here the release matrix already publishes hanzo-<platform>.tar.gz, so pointing at those means one artifact, built once. Five npm packages would be a second copy of the same bytes under a second set of version numbers, and copies drift — that is how a `latest` ends up serving last week's binary for one platform only. VERIFIED against the .sha256 the release publishes beside each asset. This script runs on every npm install and the thing it fetches is then executed: an unverified download is arbitrary code execution on every machine that installs us. The publish job `needs: build`, which is the point. The postinstall fetches assets for its own version, so publishing before they exist ships a package whose install 404s. v1.9.41 is exactly that shape from the other side — four targets uploaded, linux-amd64 did not, and the release read green while the only binary our own amd64 cluster runs was missing. The tag sets the version, not the file. package.json carrying a different number is how a release publishes bytes under a version nobody built.