5 Commits

Author SHA1 Message Date
googleworkspace-bot 705fb0ecac chore: release versions (#655) 2026-03-31 12:32:18 -06:00
Justin Poehnelt 6ccbb42650 fix: auto-install binary on run if missing (#654)
* fix: auto-install binary on run if missing

pnpm skips postinstall when the package is already cached/installed.
This commit ensures run.js will auto-trigger install.js if the
binary is missing, fixing the 'gws binary not found' error.

* chore: add changeset for pnpm binary fix

---------

Co-authored-by: jpoehnelt-bot <jpoehnelt-bot@users.noreply.github.com>
2026-03-31 11:47:43 -06:00
Justin Poehnelt 158f93afd7 fix: verify SHA256 checksum in npm postinstall script (#650)
Co-authored-by: jpoehnelt-bot <jpoehnelt-bot@users.noreply.github.com>
2026-03-31 11:41:25 -06:00
googleworkspace-bot f4ee658360 chore: release versions (#647) 2026-03-31 11:20:03 -06:00
Justin Poehnelt 86c08cfc0d fix: remove cargo-dist, use native fetch for npm installer (#646)
* chore: remove cargo-dist, use native fetch for npm installer

* fix: harden npm scripts — spawnSync, signal handling, binary-exists check

* fix: address PR review comments

- Add null body guard for fetch response
- Fix PowerShell Expand-Archive path quoting vulnerability
- Sanitize error output to prevent ANSI escape injection
- Add proxy support limitation note
- Fix upgrade bug: use .version marker so npm update downloads new binary
- Downgrade changeset from minor to patch (chore, not feature)
- Update AGENTS.md: remove stale cargo-dist reference from labels

* fix: use flat archives for consistent tar/zip extraction

Both tar.gz and zip archives now contain files at root (no nested
directory). Removes --strip-components 1 from install.js since it is
no longer needed. This makes extraction consistent across platforms.

---------

Co-authored-by: jpoehnelt-bot <jpoehnelt-bot@users.noreply.github.com>
2026-03-31 11:17:57 -06:00