Conversation
External reviewer feedback: npx is the zero-friction install for this audience
(Claude Code users are npm users by definition). Implements the platform-package
pattern (esbuild/biome/turborepo): a meta package @firstops/whittle whose bin is
a 15-line Node shim, plus four optionalDependencies (@firstops/whittle-{darwin,
linux}-{arm64,amd64}) each carrying the prebuilt Go binary with os/cpu fields so
npm installs exactly one. No postinstall scripts, npm-native integrity, works
with --ignore-scripts. Unsupported platforms (windows) get a clear error
pointing at go install and the releases page.
npm/prepare.sh assembles the five packages from a tagged GitHub release:
downloads the goreleaser assets, verifies checksums.txt, stamps the version
(npm version always mirrors a real release tag), and publishes with --publish.
Verified end to end against v0.3.0: packed, installed into a clean project, and
`npx whittle version` / `policy list` ran the real binary through the shim.
The npm name `whittle` is squatted by an abandoned 0.0.0 package (2020); using
the @firstops scope, parameterized in one place if that changes. README gains
the npm install lines only after first publish, per the no-unshipped-claims rule.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds npx as an install channel alongside go install and brew, per external reviewer feedback (Claude Code users are npm users by definition).
Platform-package pattern (esbuild/biome/turborepo): meta package
@firstops/whittlewith a 15-line Node shim + four os/cpu-gated optionalDependencies carrying the prebuilt release binaries. No postinstall scripts, npm-native integrity.npm/prepare.sh <version> [--publish]assembles everything from a tagged GitHub release with checksum verification.Verified end to end against v0.3.0: packed, installed clean,
npx whittle versionran the real binary through the shim.To publish (founder steps, ~5 min):
firstopsorg on npmjs.com (or pick another scope: one-line change in prepare.sh + shim)npm loginsh npm/prepare.sh 0.3.0 --publishREADME gets the npm install lines only after the first publish succeeds (no unshipped claims).
🤖 Generated with Claude Code