Repository navigation
Conversation
`npm ci --ignore-scripts` skips the package's postinstall, which copies the native binary over bin/claude.exe; without it `claude` is a stub that exits with "claude native binary not installed", so every publish since v1.1.0 fails at "Validate the marketplace". cli-wrapper.cjs runs the binary from the same locked platform package with no install script. The step moves into scripts/validate-marketplace.sh with a test that runs the real locked CLI against a valid and an invalid marketplace. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
pratzm
requested review from
07-C9,
farmerjPSD,
krishagel,
reeseherber and
songstadw
as code owners
November 4, 2026 22:29
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Fix "Validate the marketplace" in
reusable-publish-plugin.yml, which fails on every publish since v1.1.0 becausenpm ci --ignore-scriptsleavesclaudea stub that won't run.The package's postinstall (
install.cjs) copies the native binary from the platform package (@anthropic-ai/claude-code-<platform>) overbin/claude.exe. With--ignore-scriptsthat copy never happens, soclaudeexits with:This PR runs the CLI through the package's
cli-wrapper.cjs, which finds and runs the binary in that same locked platform package. The install stays locked and integrity-checked, and still runs no scripts. The step moves intoscripts/validate-marketplace.sh(matching the repo's other publish scripts), withscripts/validate-marketplace.test.shrun bypublish-plugin-test.yml. That workflow now also runs whentools/claude-code/changes, so a bump of the locked CLI is tested before it ships.It surfaced in psd401/psd-collab-mcp's first publish at v1.1.0: https://github.com/psd401/psd-collab-mcp/actions/runs/41918450955. A patch release (v1.2.2) would let callers pick it up through Dependabot.
AI disclosure
Claude Code (Opus 5.5), working for Mason, found the cause and wrote the script, test and workflow changes. No human has reviewed the code yet.
Evidence
tools/claude-codelockfile:npm ci --ignore-scripts, thenclaude --versiongives the error above.bash scripts/validate-marketplace.test.shgivesall passed: the valid marketplace prints "Validation passed", and the invalid one is refused withplugins: Invalid input: expected array, received string.node …/cli-wrapper.cjs plugin validate .passes on psd-collab-mcp'splugin/with the locked 2.1.293.Not changed, but stale:
publish-plugin-test.yml's ABOUTME says callers use the reusable at@main; they pin to release SHAs now.🤖 Generated with Claude Code