From bb598c78e3dd97cf38c55f98abe0898e3f2f36f7 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 14 Mar 2026 06:14:56 +0000
Subject: [PATCH] fix: harden publish verification and document fix for missing
 dist/loader.js

Co-authored-by: glittercowboy <186001655+glittercowboy@users.noreply.github.com>
---
 .github/workflows/build-native.yml | 4 ++--
 CHANGELOG.md                       | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-native.yml b/.github/workflows/build-native.yml
index 3fb4e9412..e526fa218 100644
--- a/.github/workflows/build-native.yml
+++ b/.github/workflows/build-native.yml
@@ -173,11 +173,11 @@ jobs:
         run: npm run build
 
       - name: Verify dist exists
-        run: test -f dist/loader.js || { echo "::error::dist/loader.js missing after build"; exit 1; }
+        run: test -s dist/loader.js || { echo "::error::dist/loader.js missing or empty after build"; exit 1; }
 
       - name: Verify tarball contents
         run: |
-          npm pack --dry-run 2>&1 | tee /tmp/pack-output.txt
+          npm pack --dry-run --ignore-scripts 2>&1 | tee /tmp/pack-output.txt
           grep -q "dist/loader.js" /tmp/pack-output.txt || {
             echo "::error::dist/loader.js not in tarball"
             exit 1
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d9108d648..d8df723a8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -23,6 +23,7 @@ Format based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - Eliminated branch checkout during slice merge that caused STATE.md conflicts (#307)
 - Removed infinite delivery retry loop for background job completions (#301)
 - Display ⌥ instead of Alt for keybindings on macOS (#299)
+- Publish verification checks `dist/loader.js` is non-empty (`-s`) and uses `--ignore-scripts` on `npm pack --dry-run` to match actual publish behaviour (#298)
 
 ### Removed
 - Deprecated legacy dead code from OAuth module