ai-rules (npm)

This is a thin npm wrapper, not a reimplementation. npm install/pnpm add runs scripts/postinstall.js, which downloads the real Go binary for your platform (darwin/linux, amd64/arm64) from this project's GitHub Releases and drops it at bin/ai-rules-bin; bin/ai-rules.js just execs it with your args.

See the main README for what ai-rules actually does and how to use it — this file only covers npm-specific install mechanics.

Install

npm install -g @thomas-labs/ai-rules
# or: pnpm add -g @thomas-labs/ai-rules

The source repo is private, so the postinstall download needs a GitHub token — resolved the same way the CLI's own --token flag is: checks $GITHUB_TOKEN, then $GH_TOKEN, then gh auth token. If none of those resolve to a token with read access to Thomas-xDo/ai-rules, install fails with a clear error rather than silently producing a broken ai-rules command.

pnpm-specific gotchas

Both of these are pnpm's own default behavior (not specific to ai-rules), but they've actually bitten a real install, so noting them here rather than making you rediscover them:

• "minimum release age" guard: recent pnpm (11.x) refuses to install a package published too recently, as a supply-chain-attack mitigation. If pnpm add -g @thomas-labs/ai-rules fails right after a fresh publish (possibly with a confusing internal error instead of a clean message), add --config.minimum-release-age=0.
• postinstall scripts are blocked by default: pnpm won't run a package's install/postinstall scripts unless approved, so the binary download may silently not happen even though pnpm add reports success. Run pnpm approve-builds (interactive) and select @thomas-labs/ai-rules, or pnpm approve-builds @thomas-labs/ai-rules if it's already listed as pending. If you already declined once (or hit Enter through an empty prompt), it gets recorded as denied in pnpm-workspace.yaml under the global install dir (~/Library/pnpm/global/v11/<hash>/pnpm-workspace.yaml on macOS) as allowBuilds: { '@thomas-labs/ai-rules': false } — flip that to true and run pnpm rebuild @thomas-labs/ai-rules (or, if that still doesn't trigger it, node node_modules/@thomas-labs/ai-rules/scripts/postinstall.js directly from that same dir) to actually fetch the binary.
• Plain npm install -g doesn't have either of these gates.

Why not a "real" npm package

ai-rules is a Go CLI; there's no Node code to actually publish. This wrapper exists purely so npm i -g @thomas-labs/ai-rules is a valid install path alongside gh release download and building from source — the version published here always tracks the matching Go binary release 1:1 (CI sets this package's version to the git tag before npm publish, see .github/workflows/release.yml).