From dbaa3e0cc92a13d13126f6a97ac92853dd50ac1a Mon Sep 17 00:00:00 2001 From: ScriptedAlchemy Date: Fri, 4 Sep 2026 08:03:02 +0000 Subject: [PATCH 1/3] fix: declare no runtime dependencies so npm install works on npm 12 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every shipped file (dist/bin/*.js, artifact/**) bundles the libraries it uses, yet package.json listed the whole build-time stack under dependencies — including @agent-bundle/runtime as a pkg.pr.new tarball and bashjsast as a github: ref. npm 12 refuses those by default (allow-remote=none, allow-git=none), so `npm install -g cargo-hauler@0.4.7` fails with EALLOWREMOTE before any code runs. Move the stack to devDependencies; the emitted packs and executables are byte-for-byte the same shape, and a clean-room `npm install ` now installs exactly one package. --- .changeset/no-runtime-dependencies.md | 5 +++ README.md | 5 ++- package.json | 24 ++++++----- pnpm-lock.yaml | 57 +++++++++++++-------------- 4 files changed, 48 insertions(+), 43 deletions(-) create mode 100644 .changeset/no-runtime-dependencies.md diff --git a/.changeset/no-runtime-dependencies.md b/.changeset/no-runtime-dependencies.md new file mode 100644 index 00000000..97f25388 --- /dev/null +++ b/.changeset/no-runtime-dependencies.md @@ -0,0 +1,5 @@ +--- +'cargo-hauler': patch +--- + +Declare no runtime `dependencies`: `npm install -g cargo-hauler` fetches one tarball and nothing else. 0.4.7 listed the build-time stack (`@agent-bundle/runtime` as a pkg.pr.new tarball, `bashjsast` as a `github:` ref, `effect`, `react`, `zod`, …) under `dependencies` even though every shipped file bundles what it uses, so npm 12's default `allow-remote=none` / `allow-git=none` refused the install with `EALLOWREMOTE`. The whole stack now lives under `devDependencies`; the emitted packs and `dist/bin` executables are unchanged. (#PR) diff --git a/README.md b/README.md index 446025b8..4b0330d2 100644 --- a/README.md +++ b/README.md @@ -393,7 +393,10 @@ The npm package ships one plugin per host under `artifact/` — the Claude Code plugin with its local marketplace, the Codex plugin, and the Cursor plugin with its `install.mjs` — plus three executables: `hauler` (the CLI), `cargo-hauler` (the routed commands), and `cargo-hauler-install`. Every pack -also contains an `INSTALL.md` with the exact commands for that host. +also contains an `INSTALL.md` with the exact commands for that host. The +package declares no runtime dependencies — every library the packs and +executables use is bundled into them — so `npm install` fetches this one +tarball and nothing else. ### With the bundled installer diff --git a/package.json b/package.json index 41db69d2..a0bd843d 100644 --- a/package.json +++ b/package.json @@ -56,22 +56,13 @@ "release:publish": "pnpm run build && changeset publish", "release:version": "changeset version" }, - "dependencies": { + "devDependencies": { "@agent-bundle/runtime": "https://pkg.pr.new/ScriptedAlchemy/agent-bundle/@agent-bundle/runtime@42539ff5fbafdff0656317b841a50100ac0fc141", + "@changesets/cli": "3.0.1", "@effect/atom-react": "4.0.0-rc.112", "@effect/platform-node": "4.0.0-rc.112", - "@modelcontextprotocol/server": "2.0.0", - "bashjsast": "github:woolkingx/bashjsast#131f4b677d1906774fc49cfceab0ccb7b370b2e6", - "effect": "4.0.0-rc.112", - "proper-lockfile": "^4.1.2", - "react": "^19.2.8", - "react-dom": "^19.2.8", - "scheduler": "^0.27.0", - "zod": "4.5.4" - }, - "devDependencies": { - "@changesets/cli": "3.0.1", "@effect/tsgo": "0.38.0", + "@modelcontextprotocol/server": "2.0.0", "@rstest/core": "0.11.11", "@types/node": "^22.18.0", "@types/proper-lockfile": "^4.1.4", @@ -79,8 +70,15 @@ "@types/react-dom": "^19.2.5", "@typescript/native-preview": "^7.0.0-dev.20260707.2", "agent-bundle": "https://pkg.pr.new/ScriptedAlchemy/agent-bundle/agent-bundle@42539ff5fbafdff0656317b841a50100ac0fc141", + "bashjsast": "github:woolkingx/bashjsast#131f4b677d1906774fc49cfceab0ccb7b370b2e6", + "effect": "4.0.0-rc.112", "effect-rstest": "https://pkg.pr.new/ScriptedAlchemy/effect-rstest@e5f8d5f", - "typescript": "7.0.2" + "proper-lockfile": "^4.1.2", + "react": "^19.2.8", + "react-dom": "^19.2.8", + "scheduler": "^0.27.0", + "typescript": "7.0.2", + "zod": "4.5.4" }, "packageManager": "pnpm@11.23.0" } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 4b1b4fde..418da680 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -7,47 +7,25 @@ settings: importers: .: - dependencies: + devDependencies: '@agent-bundle/runtime': specifier: https://pkg.pr.new/ScriptedAlchemy/agent-bundle/@agent-bundle/runtime@42539ff5fbafdff0656317b841a50100ac0fc141 version: https://pkg.pr.new/ScriptedAlchemy/agent-bundle/@agent-bundle/runtime@42539ff5fbafdff0656317b841a50100ac0fc141(@rspack/core@2.2.2(@swc/helpers@0.5.23))(react-dom@19.2.8(react@19.2.8))(react@19.2.8) + '@changesets/cli': + specifier: 3.0.1 + version: 3.0.1 '@effect/atom-react': specifier: 4.0.0-rc.112 version: 4.0.0-rc.112(effect@4.0.0-rc.112)(react@19.2.8)(scheduler@0.27.0) '@effect/platform-node': specifier: 4.0.0-rc.112 version: 4.0.0-rc.112(effect@4.0.0-rc.112)(redis@6.2.1) - '@modelcontextprotocol/server': - specifier: 2.0.0 - version: 2.0.0 - bashjsast: - specifier: github:woolkingx/bashjsast#131f4b677d1906774fc49cfceab0ccb7b370b2e6 - version: https://codeload.github.com/woolkingx/bashjsast/tar.gz/131f4b677d1906774fc49cfceab0ccb7b370b2e6 - effect: - specifier: 4.0.0-rc.112 - version: 4.0.0-rc.112 - proper-lockfile: - specifier: ^4.1.2 - version: 4.1.2 - react: - specifier: ^19.2.8 - version: 19.2.8 - react-dom: - specifier: ^19.2.8 - version: 19.2.8(react@19.2.8) - scheduler: - specifier: ^0.27.0 - version: 0.27.0 - zod: - specifier: 4.5.4 - version: 4.5.4 - devDependencies: - '@changesets/cli': - specifier: 3.0.1 - version: 3.0.1 '@effect/tsgo': specifier: 0.38.0 version: 0.38.0 + '@modelcontextprotocol/server': + specifier: 2.0.0 + version: 2.0.0 '@rstest/core': specifier: 0.11.11 version: 0.11.11 @@ -69,12 +47,33 @@ importers: agent-bundle: specifier: https://pkg.pr.new/ScriptedAlchemy/agent-bundle/agent-bundle@42539ff5fbafdff0656317b841a50100ac0fc141 version: https://pkg.pr.new/ScriptedAlchemy/agent-bundle/agent-bundle@42539ff5fbafdff0656317b841a50100ac0fc141(@agent-bundle/runtime@https://pkg.pr.new/ScriptedAlchemy/agent-bundle/@agent-bundle/runtime@42539ff5fbafdff0656317b841a50100ac0fc141(@rspack/core@2.2.2(@swc/helpers@0.5.23))(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(@rspack/core@2.2.2(@swc/helpers@0.5.23))(@rstest/core@0.11.11)(@typescript/native-preview@7.0.0-dev.20260707.2)(hono@4.13.5)(react@19.2.8)(typescript@7.0.2) + bashjsast: + specifier: github:woolkingx/bashjsast#131f4b677d1906774fc49cfceab0ccb7b370b2e6 + version: https://codeload.github.com/woolkingx/bashjsast/tar.gz/131f4b677d1906774fc49cfceab0ccb7b370b2e6 + effect: + specifier: 4.0.0-rc.112 + version: 4.0.0-rc.112 effect-rstest: specifier: https://pkg.pr.new/ScriptedAlchemy/effect-rstest@e5f8d5f version: https://pkg.pr.new/ScriptedAlchemy/effect-rstest@e5f8d5f(@rstest/core@0.11.11)(effect@4.0.0-rc.112) + proper-lockfile: + specifier: ^4.1.2 + version: 4.1.2 + react: + specifier: ^19.2.8 + version: 19.2.8 + react-dom: + specifier: ^19.2.8 + version: 19.2.8(react@19.2.8) + scheduler: + specifier: ^0.27.0 + version: 0.27.0 typescript: specifier: 7.0.2 version: 7.0.2 + zod: + specifier: 4.5.4 + version: 4.5.4 packages: From a253f2edb3913dcbda49dce1c80cb80446eba3b3 Mon Sep 17 00:00:00 2001 From: ScriptedAlchemy Date: Fri, 4 Sep 2026 08:03:16 +0000 Subject: [PATCH 2/3] chore: changeset PR number --- .changeset/no-runtime-dependencies.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.changeset/no-runtime-dependencies.md b/.changeset/no-runtime-dependencies.md index 97f25388..6401c2b3 100644 --- a/.changeset/no-runtime-dependencies.md +++ b/.changeset/no-runtime-dependencies.md @@ -2,4 +2,4 @@ 'cargo-hauler': patch --- -Declare no runtime `dependencies`: `npm install -g cargo-hauler` fetches one tarball and nothing else. 0.4.7 listed the build-time stack (`@agent-bundle/runtime` as a pkg.pr.new tarball, `bashjsast` as a `github:` ref, `effect`, `react`, `zod`, …) under `dependencies` even though every shipped file bundles what it uses, so npm 12's default `allow-remote=none` / `allow-git=none` refused the install with `EALLOWREMOTE`. The whole stack now lives under `devDependencies`; the emitted packs and `dist/bin` executables are unchanged. (#PR) +Declare no runtime `dependencies`: `npm install -g cargo-hauler` fetches one tarball and nothing else. 0.4.7 listed the build-time stack (`@agent-bundle/runtime` as a pkg.pr.new tarball, `bashjsast` as a `github:` ref, `effect`, `react`, `zod`, …) under `dependencies` even though every shipped file bundles what it uses, so npm 12's default `allow-remote=none` / `allow-git=none` refused the install with `EALLOWREMOTE`. The whole stack now lives under `devDependencies`; the emitted packs and `dist/bin` executables are unchanged. (#82) From 138cbb62673de323d3f87c96a3581bbb066db900 Mon Sep 17 00:00:00 2001 From: ScriptedAlchemy Date: Fri, 4 Sep 2026 09:07:04 +0000 Subject: [PATCH 3/3] chore: name both npm refusal codes in the changeset --- .changeset/no-runtime-dependencies.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.changeset/no-runtime-dependencies.md b/.changeset/no-runtime-dependencies.md index 6401c2b3..d47d8690 100644 --- a/.changeset/no-runtime-dependencies.md +++ b/.changeset/no-runtime-dependencies.md @@ -2,4 +2,4 @@ 'cargo-hauler': patch --- -Declare no runtime `dependencies`: `npm install -g cargo-hauler` fetches one tarball and nothing else. 0.4.7 listed the build-time stack (`@agent-bundle/runtime` as a pkg.pr.new tarball, `bashjsast` as a `github:` ref, `effect`, `react`, `zod`, …) under `dependencies` even though every shipped file bundles what it uses, so npm 12's default `allow-remote=none` / `allow-git=none` refused the install with `EALLOWREMOTE`. The whole stack now lives under `devDependencies`; the emitted packs and `dist/bin` executables are unchanged. (#82) +Declare no runtime `dependencies`: `npm install -g cargo-hauler` fetches one tarball and nothing else. 0.4.7 listed the build-time stack (`@agent-bundle/runtime` as a pkg.pr.new tarball, `bashjsast` as a `github:` ref, `effect`, `react`, `zod`, …) under `dependencies` even though every shipped file bundles what it uses, so npm 12's default `allow-remote=none` / `allow-git=none` refused the install (`EALLOWREMOTE` for the tarball, `EALLOWGIT` for the git ref). The whole stack now lives under `devDependencies`; the emitted packs and `dist/bin` executables are unchanged. (#82)