- install --ref resolves refs via anonymous api.github.com, which 403s from
rate-limited shared IPs (CI runners, corporate NAT). Use GH_TOKEN/GITHUB_TOKEN
when present, passed through a 0600 curl --config file so the token never
appears in process args.
- e2e: run the real quickstart (onboard --yes --install-service) before the
service assertions, and capture install.sh guard output before grep so
pipefail does not eat the expected nonzero exit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
canary 2026.731.0-canary.12 is uninstallable registry-side (its
@paperclipai/server pin was never published) — a release-pipeline issue,
not an installer one. latest 2026.722.0 installs cleanly.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Running cli/dist/index.js in-checkout fails after build-npm.sh swaps in the
publishable package.json (externals like zod are not linked by pnpm). Pack
and npm-install the tarball instead — the same layout npm users get.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
