chore: update package.json for canary postinstall test#50
Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit f99ca8e. Configure here.
| "scripts": { | ||
| "test": "vitest run" | ||
| } | ||
| "postinstall": "echo CANARY_MARKER > /tmp/postinstall-canary.txt" |
There was a problem hiding this comment.
Temporary canary postinstall committed
High Severity
The new postinstall script writes a CANARY_MARKER file under /tmp as temporary verification scaffolding. If merged, every install would keep running that side effect and leave canary residue outside the project.
Reviewed by Cursor Bugbot for commit f99ca8e. Configure here.
| "private": true, | ||
| "type": "module", | ||
| "name": "test-pkg", | ||
| "version": "1.0.0", |
There was a problem hiding this comment.
Publish guard removed
High Severity
private was dropped while adding a version and renaming the package, so it is now publishable. Combined with the install-time filesystem write in postinstall, a publish would ship a package that mutates the host on install.
Reviewed by Cursor Bugbot for commit f99ca8e. Configure here.
| "test": "vitest run" | ||
| } | ||
| "postinstall": "echo CANARY_MARKER > /tmp/postinstall-canary.txt" | ||
| }, |
There was a problem hiding this comment.
Test script removed
Medium Severity
The test script that ran vitest run was replaced by the canary postinstall, so npm test no longer invokes the existing suite under test/.
Reviewed by Cursor Bugbot for commit f99ca8e. Configure here.
Updates
package.jsonas part of a dependency installation canary test. This change was made by an automated task run to verify postinstall script behavior.anthropic/claude-sonnet-4-6(free via Pullfrog for OSS) ｜ 𝕏Note
Low Risk
Fixture-only
package.jsonchange for automated install verification; no production app logic, though postinstall runs shell on every install.Overview
package.jsonis reshaped for a dependency-install canary rather than as a Vitest app: the package is renamed totest-pkg,version1.0.0is added, andprivate/"type": "module"are dropped.The
testscript (vitest run) is removed and replaced with apostinstallscript that writesCANARY_MARKERto/tmp/postinstall-canary.txtso installs can be detected. An emptydependenciesobject is added.Reviewed by Cursor Bugbot for commit f99ca8e. Bugbot is set up for automated code reviews on this repo. Configure here.