v0.6.4

Features:

• npm-style lifecycle hooks for jarvy run — if pre<name> or
  post<name> keys exist in [commands], jarvy run <name> runs them
  around the main command with npm's exact semantics: a failing pre
  aborts the run (its exit code propagates), post only runs after a
  successful main, a failing post fails the run, and extra -- args go
  to the main command only. The more readable colon spelling works too
  ("pre:build" / "post:build", quoted — TOML bare keys can't
  contain :); when both spellings are defined the colon form wins and
  a note is printed. Hooks are ordinary entries: listed, directly
  runnable, same safety guards.
• jarvy shell-init --apply — wires the jr (= jarvy run)
  shorthand into your shell rc file with one command, whatever way you
  installed jarvy (previously nothing did this automatically —
  cargo install users never got jr without hand-editing their rc).
  Idempotent; supports bash/zsh/sh/fish/PowerShell, and nushell via a
  materialized ~/.jarvy/init.nu (re-run --apply after upgrading).
• Bare jarvy run with no [commands] table now prints a real
  getting-started guide (worked example, the three usage forms, cwd
  rule, jr tip) instead of a one-line hint.
• New docs page: Task runner
  — npm-run-style documentation including a "Coming from npm?" mapping
  table.

Fixes:

• Every jarvy invocation warned plugin directory has insecure permissions for users who never created ~/.jarvy/tools.d — the
  permission probe conflated "directory doesn't exist" with "unsafe
  permissions". An absent plugin directory is now a silent no-op; the
  security gate still fires for directories that exist with loose
  permissions.

Internal:

• verify-release-assets.sh accepts the bare-basename SHA256SUMS.txt
  entries introduced in v0.6.3 (its listing regex previously required a
  path separator before the name).
• This repo's own jarvy.toml gained a [commands] table — jarvy's
  development tasks now dogfood jarvy run.

Full Changelog: v0.6.4-rc.2...v0.6.4

Installation

Quick Install (Unix)

curl -fsSL https://raw.githubusercontent.com/Cliftonz/jarvy/main/dist/scripts/install.sh | bash

Quick Install (Windows PowerShell)

irm https://raw.githubusercontent.com/Cliftonz/jarvy/main/dist/scripts/install.ps1 | iex

Homebrew

brew install Cliftonz/tap/jarvy

Cargo

cargo install jarvy

Early-Release Channel

Pre-release tags (-rc.N, -beta.N) are routed through the beta channel.
Opt in: JARVY_CHANNEL=beta on the install script, or jarvy update --channel beta.
See docs/release-testing.md.

See installation docs for more options.

Security

Verify Signatures

All release artifacts are signed with Sigstore keyless OIDC. Verify any artifact:

# Substitute a triple that matches your platform, e.g.
# aarch64-apple-darwin, x86_64-unknown-linux-musl,
# aarch64-unknown-linux-gnu, x86_64-pc-windows-msvc (.zip).
ARTIFACT=jarvy-v0.6.4-x86_64-unknown-linux-musl.tar.gz
BASE=https://github.com/Cliftonz/jarvy/releases/download/v0.6.4
curl -LO $BASE/$ARTIFACT
curl -LO $BASE/$ARTIFACT.sig
curl -LO $BASE/$ARTIFACT.pem
cosign verify-blob \
  --signature $ARTIFACT.sig \
  --certificate $ARTIFACT.pem \
  --certificate-identity-regexp '^https://github\.com/Cliftonz/jarvy/\.github/workflows/release\.yml@refs/tags/v[0-9.]+(-[A-Za-z0-9.]+)?$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  $ARTIFACT

Tag Signature

This release was cut from a signed git tag. Verify with:

git -c gpg.ssh.allowedSignersFile=.github/allowed_signers tag --verify v0.6.4

SBOM

Software Bill of Materials in SPDX 2.3 (sbom.spdx.json) and CycloneDX 1.4 (sbom.cdx.json).

Checksums

SHA256 checksums for all artifacts are in SHA256SUMS.txt.