chore: version packages

Author: github-actions[bot]

.changeset/wild-jars-repeat.md

@@ -1,7 +1,7 @@
 {
   "name": "taskless",
   "description": "Taskless skills for code quality rules, authentication, and project management",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "author": {
     "name": "Taskless"
   },

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "private": true,
   "name": "@taskless/skills",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "license": "MIT",
   "repository": "taskless/skills.git",
   "scripts": {

package.json

@@ -1,5 +1,36 @@
 # @taskless/cli
 
+## 0.10.3
+
+### Patch Changes
+
+- db8adfa: Resolve the ast-grep binary without relying on an install-time step, and drop
+  the `@ast-grep/cli` wrapper from what consumers install.
+  - **The wrapper moves to `devDependencies`.** The seven `@ast-grep/cli-<platform>`
+    packages were already declared in `optionalDependencies`, and the CLI already
+    resolved them by path — the wrapper was a leftover whose only job is a
+    `postinstall` that hardlinks the binary into itself so its `bin` entries work.
+    Nothing here invoked those entries. Consumers now install only the platform
+    package matching their host, and the wrapper's `postinstall` — which leaves a
+    placeholder text file where the binary should be under `pnpm dlx`'s strict
+    isolation — is out of the shipped product entirely. It stays as a
+    `devDependency` because `fetch-ast-grep-schema` reads its version.
+  - **Platform packages are pinned exactly at `0.41.0`.** They were carets, and the
+    wrapper had been enforcing alignment implicitly by pinning its own
+    `optionalDependencies`; without it, two hosts could resolve different ast-grep
+    versions against the same rules and disagree about findings. Held at `0.41.0`
+    rather than taking upstream's `0.45.0`, so this change stays structural.
+  - **Binary resolution exhausts every candidate before failing.** It now searches
+    the platform package, `node_modules/.bin`, then `sg` and `ast-grep` on `PATH`,
+    and throws naming what it tried. Previously it returned a bare `"sg"` and let
+    `spawn`'s `ENOENT` be the error, from a caller that could not say where it had
+    looked.
+
+  Alpine improves as a side effect: upstream publishes no musl build and marks its
+  Linux packages `libc: ["glibc"]`, so today the wrapper's `postinstall` resolves a
+  package that does not exist and exits 1, failing the install wherever dependency
+  scripts run. Installing now succeeds and resolution falls through to `PATH`.
+
 ## 0.10.2
 
 ### Patch Changes

packages/cli/CHANGELOG.md

@@ -1,6 +1,6 @@
 {
   "name": "@taskless/cli",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "license": "MIT",
   "repository": {
     "type": "git",

packages/cli/package.json

@@ -20,7 +20,7 @@ description: |
   `taskless help route`; it does NOT suppress the skill.
 metadata:
   author: taskless
-  version: 0.10.2
+  version: 0.10.3
   commandName: tskl
 compatibility: Designed for Agents implementing the Agent Skills specification.
 ---