@bigknoxy/hashpilot 4.8.2 → 4.8.3

package/docs/decisions/README.md

@@ -88,3 +88,12 @@ Format:
 - **Decision:** Add `bun.lock` to `package.json`'s `files` array so it ships in the npm tarball. The existing `install.sh` logic already uses `--frozen-lockfile` when `bun.lock` is present.
 - **Alternatives considered:** (1) Generate a lockfile during install — rejected: defeats the purpose of pinning. (2) Keep `bun.lock` out and accept fresh resolution — rejected: supply-chain pinning gap.
 - **Consequences:** npm-installed packages now include `bun.lock` and install with `--frozen-lockfile`. The npm package size increases slightly. The `else` branch in `install.sh` (lines 423-432) becomes unreachable for current npm installs but is kept as a safe fallback.
+
+## D010: npm-sourced installs with a shipped bun.lock use --frozen-lockfile --production
+
+- **Date:** 2026-09-06
+- **PR:** hotfix (after v4.8.2)
+- **Context:** v4.8.2 shipped broken for the **default npm install path**. D007 (#199) added `bun.lock` to the npm package's `files`; the dependency-mode guard from #194 treated `NPM_INSTALLED=true && bun.lock present` as a fatal ("refusing to guess which dependency mode is correct"). D007 made that guard's fire-branch the *normal* case, so every fresh npm install of v4.8.2 aborted before installing dependencies. The bug passed CI because smoke installs from `@latest` npm — main's run predated the semantic-release publish and tested 4.8.1 (no lockfile); the breakage only surfaced once v4.8.2 reached the registry.
+- **Decision:** The dependency-mode decision now keys off `$NPM_INSTALLED`, not a bare lockfile-presence check. npm source + shipped lock → `bun install --frozen-lockfile --production` (pinned, devDeps skipped). npm source, no lock → `--production` (legacy). git/local + lock → `--frozen-lockfile` (dev wants devDeps). git/local, no lock → hard error (unchanged).
+- **Alternatives considered:** (1) Revert D007 (don't ship bun.lock) — rejected: pinning transitive deps is the correct supply-chain posture; the packaging was not the flaw, the mode-selector was. (2) Remove the #194 guard entirely and let the old `[ -f bun.lock ]` branch run plain `--frozen-lockfile` — rejected: that would pull devDependencies (semantic-release) into npm installs, breaking the smoke's devDep-exclusion assertion and bloating user installs.
+- **Consequences:** npm-installed packages are pinned to the shipped lockfile while still skipping devDeps. **Coverage hole identified:** smoke's npm-path test installs `@latest` (published version), so an unpublished PR branch is never validated against its own packed tarball — add a version-consistency guard so "testing the wrong release" is loud, not silent.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bigknoxy/hashpilot",
-  "version": "4.8.2",
+  "version": "4.8.3",
   "description": "HashPilot — Global Tool-Agnostic Structured Editing Core for Coding Agents",
   "type": "module",
   "engines": {

package/scripts/install.sh

@@ -405,31 +405,45 @@ log "Installing dependencies..."
 # (e.g. an npm extraction that somehow shipped a lockfile, or a git/local
 # source that's missing one) fails loudly here instead of silently
 # guessing.
-if [ "$NPM_INSTALLED" = "true" ] && [ -f "$SOURCE_DIR/bun.lock" ]; then
-  err "npm-sourced install unexpectedly has a bun.lock — refusing to guess which dependency mode is correct"
-  exit 1
-fi
 if [ "$NPM_INSTALLED" = "false" ] && [ ! -f "$SOURCE_DIR/bun.lock" ]; then
   err "Source is missing bun.lock and wasn't installed from npm — refusing to guess which dependency mode is correct"
   err "(local-clone and --source installs are expected to have bun.lock, same as the git repo does)"
   exit 1
 fi
 
-if [ -f "$SOURCE_DIR/bun.lock" ]; then
+# Dependency mode decided here, not by a bare [ -f bun.lock ] presence check:
+#   - git/local source with bun.lock  -> --frozen-lockfile (dev wants devDeps)
+#   - npm source with bun.lock (D007) -> --frozen-lockfile --production (pinned,
+#     but skip devDeps — the npm package lists them in package.json even though
+#     `files` excludes them; a plain --frozen-lockfile would pull semantic-release)
+#   - npm source without bun.lock     -> --production (legacy, pre-D007)
+if [ "$NPM_INSTALLED" = "true" ]; then
+  # npm always skips devDependencies. When the shipped lockfile is present
+  # (D007), pin to it too; otherwise resolve production deps fresh.
+  if [ -f "$SOURCE_DIR/bun.lock" ]; then
+    detail "bun.lock shipped (npm package) — installing pinned production dependencies"
+    cd "$TARGET_DIR/structured-editing"
+    bun install --frozen-lockfile --production 2>&1 | while IFS= read -r line; do detail "$line"; done
+    cd "$OLDPWD"
+  else
+    # The npm-published package.json still lists devDependencies (npm's
+    # `files` field controls which FILES ship, not which package.json fields
+    # do) — a plain `bun install` would resolve and install semantic-release,
+    # fast-check, and the rest of the dev toolchain for no reason on an end
+    # user's machine. --production skips them; the CLI never needs them.
+    detail "No bun.lock shipped (npm package install) — resolving production dependencies fresh"
+    rm -f "$TARGET_DIR/structured-editing/bun.lock"
+    cd "$TARGET_DIR/structured-editing"
+    bun install --production 2>&1 | while IFS= read -r line; do detail "$line"; done
+    cd "$OLDPWD"
+  fi
+elif [ -f "$SOURCE_DIR/bun.lock" ]; then
   cd "$TARGET_DIR/structured-editing"
   bun install --frozen-lockfile 2>&1 | while IFS= read -r line; do detail "$line"; done
   cd "$OLDPWD"
 else
-  # The npm-published package.json still lists devDependencies (npm's
-  # `files` field controls which FILES ship, not which package.json fields
-  # do) — a plain `bun install` would resolve and install semantic-release,
-  # fast-check, and the rest of the dev toolchain for no reason on an end
-  # user's machine. --production skips them; the CLI never needs them.
-  detail "No bun.lock shipped (npm package install) — resolving production dependencies fresh"
-  rm -f "$TARGET_DIR/structured-editing/bun.lock"
-  cd "$TARGET_DIR/structured-editing"
-  bun install --production 2>&1 | while IFS= read -r line; do detail "$line"; done
-  cd "$OLDPWD"
+  err "Source has no bun.lock and was not installed from npm — nothing to pin against"
+  exit 1
 fi
 detail "Dependencies installed"