Ship Alpha 0.1.0-alpha.2 so Homebrew matches main

.github/ISSUE_TEMPLATE/install-failure.yml

@@ -9,9 +9,9 @@ body:
         Simulator Broker is **Alpha**, **macOS-only**, and needs **Xcode** to
         create or run iOS Simulators. Install the CLI with
         `brew install fiveonecode/simulator-broker/simbroker` or
-        `npm install -g` of the `simbroker-0.1.0-alpha.1.tgz` from GitHub
-        Releases. A signed, notarized operator app zip is not attached to
-        this Alpha release.
+        `npm install -g` of the `simbroker-0.1.0-alpha.2.tgz` from GitHub
+        Releases. Install the operator app with
+        `brew install --cask fiveonecode/simulator-broker/simulator-broker`.
 
         Do not paste credentials, private home paths, customer data, or
         live lease files. Redact logs first. Security reports go through
@@ -23,7 +23,8 @@ body:
       label: What install path did you use?
       options:
         - Homebrew (`brew install fiveonecode/simulator-broker/simbroker`)
-        - npm (`npm install -g` of `simbroker-0.1.0-alpha.1.tgz` from GitHub Releases)
+        - npm (`npm install -g` of `simbroker-0.1.0-alpha.2.tgz` from GitHub Releases)
+        - Homebrew cask (`brew install --cask fiveonecode/simulator-broker/simulator-broker`)
         - CLI-only (`bash scripts/install_local.sh --cli-only`)
         - Contributor app + CLI (`npm run install:local`)
         - Alpha CLI tarball from GitHub Releases

CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.0-alpha.2] - 2026-08-20
+
+This tag is the first Homebrew CLI tarball, npm tarball, and notarized
+app zip that match the public first-run docs on `main`.
+
 ### Changed
 
 - Public first-run order is Homebrew CLI, Homebrew cask, then **Set Up This
@@ -19,11 +24,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   create simulators.
 - The app **Finish Local Broker Installation** copy leads with
   `brew install fiveonecode/simulator-broker/simbroker` and **Refresh**.
-  Refresh now discovers `simbroker` in Homebrew prefix `bin` (`/opt/homebrew`
-  and `/usr/local`) as well as `install.json` and `~/.local/bin`.
+  Refresh now discovers `simbroker` in Homebrew prefix `bin` as well as
+  `install.json` and the clone-install default bin.
 - `host init --bootstrap-config` `runtime-not-found` errors name
   `--ios-version` and `xcrun simctl list runtimes`. Default starter iOS
   stays `18`.
+- Formula, cask, README npm URL, and SECURITY supported version now name
+  `0.1.0-alpha.2`.
 
 ### Added
 
@@ -33,11 +40,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   for that tap name. `Formula/` and `Casks/` here stay the source of truth.
 - Homebrew cask `Casks/simulator-broker.rb` installs `Simulator Broker.app`
   from the signed, notarized GitHub Release zip `Simulator-Broker-<version>.zip`.
-  Tag `v0.1.0-alpha.1` now attaches that zip, and the cask pins its SHA-256.
+  This tag attaches that zip, and the cask pins its SHA-256.
 - Packable npm CLI `packages/simbroker` (`npm run package:npm`) with a `bin`
   field. The repo-root package stays private. Tag-driven
-  `.github/workflows/release.yml` attaches that tarball and no longer
-  claims the release is not a Homebrew formula or npm package.
+  `.github/workflows/release.yml` attaches that tarball.
 
 ## [0.1.0-alpha.1] - 2026-08-18
 

Casks/simulator-broker.rb

@@ -1,6 +1,6 @@
 cask "simulator-broker" do
-  version "0.1.0-alpha.1"
-  sha256 "5e19d128bf8061d5e18812c092e8a3b8e5f4514ff42bc233baa643fb0f075f70"
+  version "0.1.0-alpha.2"
+  sha256 "1135d767cb6eb4944ed389f7b57af808b7046b00078875bef79ad50ee14c6e40"
 
   url "https://github.com/fiveonecode/simulator-broker/releases/download/v#{version}/Simulator-Broker-#{version}.zip"
   name "Simulator Broker"

Formula/simbroker.rb

@@ -1,8 +1,8 @@
 class Simbroker < Formula
   desc "Local iOS Simulator control plane CLI"
   homepage "https://github.com/fiveonecode/simulator-broker"
-  url "https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.1/simulator-broker-0.1.0-alpha.1-cli.tar.gz"
-  sha256 "699695bc65a5bcb25b9c9b5d01494fcc3f25a40dcc90b8b5bf1ec61ea87a8522"
+  url "https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.2/simulator-broker-0.1.0-alpha.2-cli.tar.gz"
+  sha256 "f4b8740ff21ce6e7c6a3544e2811c1836d7132aaf3682d9e1c071732c80c7abe"
   license "MIT"
 
   depends_on :macos

README.md

@@ -65,7 +65,7 @@ inventory you cannot afford to change.
 Other CLI install options:
 
 ```bash
-npm install -g https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.1/simbroker-0.1.0-alpha.1.tgz
+npm install -g https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.2/simbroker-0.1.0-alpha.2.tgz
 simbroker --help
 ```
 

SECURITY.md

@@ -3,11 +3,11 @@
 ## Supported Versions
 
 Security fixes are considered for the current `main` branch and for the latest
-tagged Alpha (`0.1.0-alpha.1`). Older Alpha tags are not supported. The
+tagged Alpha (`0.1.0-alpha.2`). Older Alpha tags are not supported. The
 published CLI artifacts are the GitHub Release tarball, the Homebrew
 formula that installs that tarball, and the packable `simbroker` npm
 package, and the signed, notarized operator app zip
-`Simulator-Broker-0.1.0-alpha.1.zip`.
+`Simulator-Broker-0.1.0-alpha.2.zip`.
 
 ## Reporting A Vulnerability
 

docs/getting-started.md

@@ -38,7 +38,7 @@ in this repository stay the source of truth.
 ## Install the CLI with npm
 
 ```bash
-npm install -g https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.1/simbroker-0.1.0-alpha.1.tgz
+npm install -g https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.2/simbroker-0.1.0-alpha.2.tgz
 command -v simbroker
 simbroker --help
 ```

docs/test/front-door.test.mjs

@@ -12,6 +12,9 @@ function readRepoFile(relativePath) {
   return fs.readFileSync(path.join(repoRoot, relativePath), "utf8");
 }
 
+const packageJson = JSON.parse(readRepoFile("package.json"));
+const version = packageJson.version;
+
 function firstScreen(markdown) {
   const lines = markdown.split(/\r?\n/);
   const headingIndexes = [];
@@ -192,16 +195,16 @@ test("README advertises GitHub Releases and the public Node CI badge", () => {
   assert.ok(readme.includes("brew install --cask fiveonecode/simulator-broker/simulator-broker"));
   assert.ok(readme.includes("homebrew-simulator-broker"));
   assert.ok(readme.includes("npm install -g"));
-  assert.ok(readme.includes("simbroker-0.1.0-alpha.1.tgz"));
+  assert.ok(readme.includes(`simbroker-${version}.tgz`));
   assert.equal(readme.includes("is not attached"), false);
 });
 
 test("CHANGELOG and package.json name the Alpha version", () => {
   const changelog = readRepoFile("CHANGELOG.md");
-  const packageJson = JSON.parse(readRepoFile("package.json"));
 
-  assert.equal(packageJson.version, "0.1.0-alpha.1");
-  assert.ok(changelog.includes("## [0.1.0-alpha.1]"));
+  assert.equal(packageJson.version, version);
+  assert.match(version, /^0\.1\.0-alpha\.\d+$/);
+  assert.ok(changelog.includes(`## [${version}]`));
   assert.ok(changelog.includes("scripts/package_cli.sh"));
 });
 
@@ -251,7 +254,9 @@ test("issue forms cover install failure, bug, and feature and state Alpha limits
   assert.ok(install.includes("install_local.sh --cli-only"));
   assert.ok(install.includes("brew install fiveonecode/simulator-broker/simbroker"));
   assert.ok(install.includes("npm install -g"));
-  assert.ok(install.includes("simbroker-0.1.0-alpha.1.tgz"));
+  assert.ok(install.includes(`simbroker-${version}.tgz`));
+  assert.ok(install.includes("brew install --cask fiveonecode/simulator-broker/simulator-broker"));
+  assert.equal(install.includes("operator app zip is not attached"), false);
   assert.ok(bug.includes("labels:"));
   assert.ok(feature.includes("enhancement"));
   for (const body of [install, bug, feature, config]) {
@@ -347,19 +352,20 @@ test("Homebrew formula points at the Alpha CLI tarball and the cask names a nota
   assert.ok(url, "formula must have a url");
   assert.equal(
     url[1],
-    "https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.1/simulator-broker-0.1.0-alpha.1-cli.tar.gz",
+    `https://github.com/fiveonecode/simulator-broker/releases/download/v${version}/simulator-broker-${version}-cli.tar.gz`,
   );
   assert.ok(checksum, "formula must pin a sha256");
-  assert.equal(checksum[1], "699695bc65a5bcb25b9c9b5d01494fcc3f25a40dcc90b8b5bf1ec61ea87a8522");
+  assert.match(checksum[1], /^[a-f0-9]{64}$/);
   assert.ok(formula.includes('shell_output("#{bin}/simbroker --help")'));
   assert.equal(formula.includes("package:local"), false);
 
   assert.ok(cask.includes('cask "simulator-broker"'));
+  assert.ok(cask.includes(`version "${version}"`));
   assert.ok(cask.includes("releases/download/v#{version}/Simulator-Broker-#{version}.zip"));
   assert.ok(cask.includes('app "Simulator Broker.app"'));
   const caskChecksum = cask.match(/sha256 "([a-f0-9]{64})"/);
   assert.ok(caskChecksum, "cask must pin a sha256");
-  assert.equal(caskChecksum[1], "5e19d128bf8061d5e18812c092e8a3b8e5f4514ff42bc233baa643fb0f075f70");
+  assert.match(caskChecksum[1], /^[a-f0-9]{64}$/);
   assert.equal(cask.includes("sha256 :no_check"), false);
   assert.equal(cask.includes("package:local"), false);
   assert.equal(cask.includes("package_local"), false);
@@ -386,7 +392,7 @@ test("root package stays private and package_npm.sh packs a runnable simbroker b
   });
   assert.equal(pack.status, 0, pack.stderr + pack.stdout);
 
-  const tarball = path.join(outputDir, "simbroker-0.1.0-alpha.1.tgz");
+  const tarball = path.join(outputDir, `simbroker-${version}.tgz`);
   assert.equal(fs.existsSync(tarball), true, pack.stdout);
 
   const installDir = path.join(outputDir, "prefix");
@@ -415,7 +421,7 @@ test("package_cli.sh writes a runnable CLI tarball without tests or the app", ()
   });
 
   assert.equal(result.status, 0, result.stderr);
-  const tarball = path.join(outputDir, "simulator-broker-0.1.0-alpha.1-cli.tar.gz");
+  const tarball = path.join(outputDir, `simulator-broker-${version}-cli.tar.gz`);
   const checksum = `${tarball}.sha256`;
   assert.equal(fs.existsSync(tarball), true, result.stdout);
   assert.equal(fs.existsSync(checksum), true, result.stdout);
@@ -425,7 +431,7 @@ test("package_cli.sh writes a runnable CLI tarball without tests or the app", ()
   const extract = spawnSync("tar", ["-xzf", tarball, "-C", extractDir], { encoding: "utf8" });
   assert.equal(extract.status, 0, extract.stderr);
 
-  const root = path.join(extractDir, "simulator-broker-0.1.0-alpha.1-cli");
+  const root = path.join(extractDir, `simulator-broker-${version}-cli`);
   const help = spawnSync(path.join(root, "bin/simbroker"), ["--help"], { encoding: "utf8" });
   assert.equal(help.status, 0, help.stderr);
   assert.ok(help.stdout.includes("simbroker") || help.stderr.includes("simbroker"));

package.json

@@ -32,7 +32,7 @@
     "test:package-smoke": "bash ./scripts/package_smoke.sh",
     "verify:public-surface": "node client/public-surface.mjs"
   },
-  "version": "0.1.0-alpha.1",
+  "version": "0.1.0-alpha.2",
   "description": "Local simulator broker and macOS operator app for coordinated iOS Simulator workflows",
   "license": "MIT",
   "repository": {

packages/simbroker/README.md

@@ -4,7 +4,7 @@ Alpha CLI for Simulator Broker. Node.js 20 or newer is required. Creating and
 running iOS Simulators still requires macOS and Xcode.
 
 ```bash
-npm install -g https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.1/simbroker-0.1.0-alpha.1.tgz
+npm install -g https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.2/simbroker-0.1.0-alpha.2.tgz
 simbroker --help
 ```
 

packages/simbroker/package.json

@@ -1,6 +1,6 @@
 {
   "name": "simbroker",
-  "version": "0.1.0-alpha.1",
+  "version": "0.1.0-alpha.2",
   "private": false,
   "description": "CLI for the local iOS Simulator control plane",
   "license": "MIT",

spec/README.md

@@ -54,7 +54,7 @@ This repo exists to develop a reusable local simulator broker:
 - local install, local-debug portable packaging, Release distribution packaging, and onboarding flows now exist through `install_local.sh`, `install_local.sh --cli-only`, `package_local.sh`, `package_distribution.sh`, `test:install-smoke`, `test:package-smoke`, `host init --bootstrap-config`, and `project init`
 - the published onboarding docs now distinguish CLI-only install, repo-local contributor app+CLI install, local-debug portable bundling, and signed distribution packaging; a new login shell should resolve `simbroker` after install without sourcing `env.sh`
 - `CONTRIBUTING.md` publishes a public-patch track (Node.js 20 and the Node test suites, no harness session) and a labeled maintainer/agent harness track; `agent:complete` enforcement is unchanged
-- tagged Alpha `0.1.0-alpha.1` publishes a CLI tarball from `scripts/package_cli.sh` and runs the Node test surface on GitHub-hosted Ubuntu CI; the macOS app suite is not on that job
+- tagged Alpha `0.1.0-alpha.2` publishes a CLI tarball from `scripts/package_cli.sh`, the packable npm CLI, and a notarized operator app zip, and runs the Node test surface on GitHub-hosted Ubuntu CI; the macOS app suite is not on that job
 - GitHub issue forms cover install failure, bug, and feature; the pull-request
   template is a public-patch checklist and does not require a harness session
 - Homebrew formula `Formula/simbroker.rb` and packable npm CLI

spec/build-and-test.md

@@ -55,11 +55,12 @@ A first extracted implementation slice now exists:
   app snapshot must inject the fixture `simctl` adapter. The default
   public-surface scan reads index blobs only for dirty or missing worktree
   files so a clean checkout does not spawn one `git cat-file` per file.
-- tagged versions such as `v0.1.0-alpha.1` attach the CLI tarball, the
+- tagged versions such as `v0.1.0-alpha.2` attach the CLI tarball, the
   packable `simbroker-<version>.tgz`, and the notarized
   `Simulator-Broker-<version>.zip` to a GitHub Release. The CLI and npm
   tarballs come from `.github/workflows/release.yml`; the app zip is an
-  operator-signed notarized attach for this Alpha.
+  operator-signed notarized attach for this Alpha. The Homebrew formula
+  and cask pin the current tagged artifacts.
 - local-debug portable bundle support through a zip bundle plus package-smoke verification of the bundled install path and installed-app launch proof
 - a separate Release distribution packaging path that requires operator-supplied signing inputs, runs `codesign` plus `spctl`, optionally notarizes with `notarytool`, and writes a readiness summary JSON
 - executable `agent-harness/` changes now route through the implementation