From 71686b6290118ea1663d7a96053a6866e221a224 Mon Sep 17 00:00:00 2001 From: Chisanan232 Date: Mon, 1 Jun 2026 21:18:16 +0800 Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B=20(npm):=20Ship=20scripts/postinst?= =?UTF-8?q?all.mjs=20in=20published=20tarball?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit v0.0.1-alpha.3 published successfully (AAASM-2190 access-public fix worked) but the tarball was broken on consumer install: npm error Cannot find module '.../scripts/postinstall.mjs' Root cause: package.json declares scripts.postinstall = "node ./scripts/postinstall.mjs" but the files: array doesn't include scripts/ — only dist/, native/, README, LICENSE. So npm pack ships package.json + dist/ + native/ but NOT the postinstall script it tries to run. Fix: add scripts/postinstall.mjs to the files: array. Verified locally: $ pnpm pack $ tar -tzf agent-assembly-sdk-0.0.1-alpha.3.tgz | grep postinstall package/scripts/postinstall.mjs ← present $ cd /tmp/fresh-dir $ npm install /tmp/agent-assembly-sdk-0.0.1-alpha.3.tgz added 36 packages, audited 37 packages in 5s 0 vulnerabilities ← no postinstall error The existing @agent-assembly/sdk@0.0.1-alpha.{1,2,3} on the npm registry are unusable by end users (same bug as alpha-3). After this PR merges + a new tag publishes, consider deprecating the 3 broken pre-release versions on npm — `npm deprecate @agent-assembly/sdk@ "broken postinstall, use newer"`. Tracked: AAASM-2326 --- package.json | 1 + 1 file changed, 1 insertion(+) diff --git a/package.json b/package.json index afab17f..569ab48 100644 --- a/package.json +++ b/package.json @@ -82,6 +82,7 @@ }, "files": [ "dist/", + "scripts/postinstall.mjs", "native/aa-ffi-node/*.node", "native/aa-ffi-node/index.cjs", "native/aa-ffi-node/index.d.ts",