onbuzz 5.4.4 → 5.4.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "onbuzz",
-  "version": "5.4.4",
+  "version": "5.4.7",
   "description": "Loxia OnBuzz - Your AI Fleet",
   "type": "module",
   "main": "src/index.js",
@@ -204,4 +204,4 @@
     "glob",
     "rimraf"
   ]
-}
+}

package/scripts/verify-optional-deps.js

@@ -77,6 +77,18 @@ const SOFT_REQUIRED = [
     breaks: 'Electron in-app auto-update dialog + background download',
     fixHint: 'npm install --save-optional electron-updater@^6.8.3',
   },
+  {
+    name: '@nut-tree-fork/nut-js',
+    // Used by src/tools/desktop/osController.js (lazy dynamic import).
+    // ~30MB native module — MUST stay in optionalDependencies so a failed
+    // native build (Wayland, minimal containers) degrades to the
+    // NATIVE_UNAVAILABLE fallback instead of breaking the whole install.
+    // This entry exists because the dep was MISSING from package.json for
+    // months (field report: agents told users to `npm install` it by
+    // hand) — never let an audit-fix quietly reintroduce that gap.
+    breaks: 'DesktopTool (OS-level mouse/keyboard/screen control) — agents instruct users to install it manually',
+    fixHint: 'npm install --save-optional @nut-tree-fork/nut-js@^4.2.6',
+  },
   {
     name: 'jsdom',
     // Required by widget runtime/acceptance tests (84 tests across
@@ -106,8 +118,15 @@ const SOFT_REQUIRED = [
   },
 ];
 
+// --simulate-missing=<name,name>: treat the named deps as missing even when
+// they resolve. Dry-run tool — lets an operator (or a test) verify the banner
+// and the emitted restore command without actually uninstalling anything.
+const simArg = process.argv.find((a) => a.startsWith('--simulate-missing='));
+const simulated = new Set(simArg ? simArg.split('=')[1].split(',').filter(Boolean) : []);
+
 const missing = [];
 for (const dep of SOFT_REQUIRED) {
+  if (simulated.has(dep.name)) { missing.push(dep); continue; }
   try {
     require.resolve(dep.name, { paths: [repoRoot] });
   } catch {
@@ -120,14 +139,29 @@ if (missing.length === 0) process.exit(0);
 // --emit-install: print a single composite `npm install ...` command to
 // stdout (separate from the stderr banner). release.bat captures stdout
 // for the [r]estore path. Newline-terminated, no extra logging on stdout.
+//
+// Deps are GROUPED by the save flag in their fixHint: restoring an
+// optionalDependency (electron-updater, nut-js) with a flat `--save` would
+// silently relocate it into hard `dependencies` — turning "native build may
+// fail, that's fine" into "native build failure breaks the whole install".
+// Groups are chained with ` && ` (cmd.exe and sh both honor it).
 if (process.argv.includes('--emit-install')) {
-  const args = missing.map((m) => {
+  const groups = { '--save': [], '--save-optional': [], '--save-dev': [] };
+  for (const m of missing) {
     // Pull the version pin out of the fixHint ("npm install pkg@^x.y.z   # …").
     // Falls back to no-pin if the hint doesn't follow the convention.
     const match = m.fixHint.match(/(@?[\w/.-]+@[\^~]?[\w.-]+)/);
-    return match ? match[1] : m.name;
-  }).join(' ');
-  process.stdout.write(`npm install --save ${args}\n`);
+    const spec = match ? match[1] : m.name;
+    const flag = m.fixHint.includes('--save-optional') ? '--save-optional'
+      : m.fixHint.includes('--save-dev') ? '--save-dev'
+      : '--save';
+    groups[flag].push(spec);
+  }
+  const cmd = Object.entries(groups)
+    .filter(([, specs]) => specs.length > 0)
+    .map(([flag, specs]) => `npm install ${flag} ${specs.join(' ')}`)
+    .join(' && ');
+  process.stdout.write(`${cmd}\n`);
   // Banner still went to stderr above.
   process.exit(1);
 }