Repository navigation
fix: declare no runtime dependencies so npm install cargo-hauler works on npm 12 - #82
Conversation
Every shipped file (dist/bin/*.js, artifact/**) bundles the libraries it uses, yet package.json listed the whole build-time stack under dependencies — including @agent-bundle/runtime as a pkg.pr.new tarball and bashjsast as a github: ref. npm 12 refuses those by default (allow-remote=none, allow-git=none), so `npm install -g cargo-hauler@0.4.7` fails with EALLOWREMOTE before any code runs. Move the stack to devDependencies; the emitted packs and executables are byte-for-byte the same shape, and a clean-room `npm install <tarball>` now installs exactly one package.
🦋 Changeset detectedLatest commit: 138cbb6 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
@codex review |
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
Problem
A fresh
npm install -g cargo-hauler@0.4.7fails for anyone on npm 12 (Node 24+):npm 12 ships
allow-remote=noneandallow-git=noneby default.package.jsonlisted@agent-bundle/runtime(pkg.pr.new tarball) andbashjsast(github:ref) underdependencies, pluseffect,react,zod, MCP SDK, etc. None of it is needed at install or run time: every file indist/binandartifact/**imports only Node built-ins (verified on the published tarball), because agent-bundle bundles all dependencies into the outputs. The README's "the agent-bundle framework is a development dependency only" was the intent; the manifest said otherwise.Change
dependenciestodevDependencies. Build,validate, andtypecheckare unaffected (same packages, same versions, same lockfile resolution).Proof
pnpm run build && npm pack, then in an empty directory with stock npm 12.0.2 defaults:Upstream, agent-bundle PR #547 adds prepack diagnostics
AB7014(a declared dependency no packed JS imports) andAB7015(git / remote / path dependency specifier) so this cannot ship again; run against this repo's 0.4.7 tarball it reports exactly the 11 unused entries and the 2 non-registry specifiers fixed here.Follow-up (not in this PR)
npm 12 prints
1 package had install scripts blocked … cargo-hauler (prepare: effect-tsgo patch …)on consumer installs. Thepreparescript is a contributor-only step; it does not run for tarball installs, but the warning is noise worth removing from the published manifest.