Skip to content

test: canary package.json for dep install behavior test#11

Open
pullfrog[bot] wants to merge 19 commits into
mainfrom
pullfrog/dep-install-canary-test
Open

test: canary package.json for dep install behavior test#11
pullfrog[bot] wants to merge 19 commits into
mainfrom
pullfrog/dep-install-canary-test

Conversation

@pullfrog
Copy link
Copy Markdown

@pullfrog pullfrog Bot commented Apr 7, 2026

Captures the package.json written during the dependency installation behavior test. The file was replaced as part of verifying whether postinstall scripts run during pullfrog_start_dependency_installation / await_dependency_installation.

Result: install failed (npm ci requires a lockfile) and the canary file was not created — consistent with both the failure and the --ignore-scripts flag used by the installer.

Pullfrog  | Triggered by Pullfrog | Using Claude Opus𝕏


Note

Low Risk
Low risk: only modifies package.json metadata and adds a postinstall script used for install-behavior testing, with no application/runtime code changes.

Overview
Swaps package.json to a minimal test package (name/version) and adds a postinstall script that writes a canary file to /tmp to detect whether install scripts are executed.

Removes prior private/type: module fields and the vitest test script, leaving an empty dependencies set.

Reviewed by Cursor Bugbot for commit ce1bd41. Bugbot is set up for automated code reviews on this repo. Configure here.

@pullfrog pullfrog Bot force-pushed the pullfrog/dep-install-canary-test branch from 3c2f727 to 144187c Compare April 15, 2026 18:06
@pullfrog pullfrog Bot force-pushed the pullfrog/dep-install-canary-test branch from 144187c to ed2df9d Compare April 16, 2026 23:20
Copy link
Copy Markdown

@cursor cursor Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 3abf0b2. Configure here.

Comment thread package.json
}
"postinstall": "echo CANARY_MARKER > /tmp/postinstall-canary.txt"
},
"dependencies": {}
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Test canary package.json replaces real project configuration

High Severity

The repository's root package.json has been entirely replaced with a temporary test/canary file. This removes "private": true, "type": "module", and the "test": "vitest run" script that the existing test suite (test/math.test.ts importing from vitest) depends on. It also introduces a postinstall script that writes to /tmp. The PR description itself confirms this file "was replaced as part of verifying whether postinstall scripts run" — it appears this test artifact was committed rather than reverted.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 3abf0b2. Configure here.

pullfrog Bot added 16 commits May 1, 2026 02:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants