0xrsydn/idx-cli
1
mirror of https://github.com/0xrsydn/idx-cli.git synced 2026-11-07 01:35:36 +00:00
Code Issues Projects Releases 1 Packages Wiki Activity

fix(npm): install the binary on first run when postinstall was skipped

Browse source 
npm 12 blocks install scripts of unapproved packages under `npx` and
`npm install -g` (its allow-scripts policy). The postinstall download never
ran, so `npx -y idx-mcp` exited with "installed binary not found" and MCP
clients saw only "Connection closed". Hermes Agent hits this by default: it
runs a bare `npx` with its own npm 12.

The launcher now runs the installer itself when the binary is missing,
logging to stderr so the idx-mcp stdout channel stays clean. This also covers
pnpm 10+ and bun, which skip dependency scripts by default.

npm-smoke installs idx-mcp with --ignore-scripts and checks that the first
run still starts cleanly.

Fixes #41

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WB13omP6h7YeyJx7GNtUnF
This commit is contained in:
hermes 2026-10-16 04:40:40 +00:00
commit bdbcf62a7b
5 changed files with 44 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

21
docs/NPM_DISTRIBUTION.md
View file

@ -43,11 +43,16 @@ version `0.3.1` downloads assets from the `v0.3.1` GitHub Release.
The postinstall script downloads `SHA256SUMS` from the same release and
refuses to install a binary whose checksum does not match.
### pnpm and bun
### When postinstall does not run
pnpm 10+ and bun do not run dependency lifecycle scripts by default, so the
binary is never downloaded and `idx` reports that it is missing. Allow the
postinstall script explicitly:
npm 12 blocks install scripts of unapproved packages under `npx` and
`npm install -g` (its `allow-scripts` policy), and pnpm 10+ and bun skip
dependency lifecycle scripts by default. The launcher then runs the installer
itself on first start, logging to stderr so the `idx-mcp` stdout channel stays
clean; it fails only when that download fails too. Hermes Agent runs `npx` with
its own npm 12, which is how 0.3.1 broke there (issue #41).
To install the binary up front instead, allow the script explicitly:
```bash
# pnpm
@ -55,15 +60,17 @@ pnpm add --global --allow-build=idx-cli idx-cli
# bun
bun add --global --trust idx-cli
```
Plain `npm install` and `npx` run the postinstall script normally.
# npm 12
npm install --global --allow-scripts=idx-cli idx-cli
```
## Local smoke test
The smoke script builds or reuses `target/release/idx`, packs the npm wrapper,
installs the tarball into a new temporary directory, and runs the installed
`idx` command. It uses `IDX_BINARY_URL` with a local `file:` URL, so the test
`idx` command, then installs `idx-mcp` again with `--ignore-scripts` to check
the launcher's first-run install. It uses `IDX_BINARY_URL` with a local `file:` URL, so the test
does not need a registry publish or a network download.
```bash