test: add E2E tests for npm install pipeline

[anandgupta42]

Summary

• Add test/install/ test suite exercising the three key install pipeline components: postinstall script, bin wrapper, and publish output structure
• Tests build fake npm directory layouts in temp dirs and run the real scripts as subprocesses — no npm install, credentials, or network access needed
• Catches the class of failure where an expired npm auth token causes optionalDependencies to silently fail, leaving the postinstall script to crash

Test plan

• bun test test/install/ — 24 tests pass, 0 failures, 66 assertions
• Verify CI runs the new tests successfully

🤖 Generated with Claude Code

[jontsai]

PR #50 Review Tour Guide

test: add E2E tests for npm install pipeline

#	File	+/-	Purpose
1	test/install/fixture.ts	+110	Shared test helpers: temp dirs, fake package layouts, script runners
2	test/install/postinstall.test.ts	+123	7 tests for postinstall.mjs
3	test/install/bin-wrapper.test.ts	+116	6 tests for bin/altimate-code wrapper
4	test/install/integration.test.ts	+95	3 end-to-end pipeline tests
5	test/install/publish-package.test.ts	+75	8 tests validating publish structure

Tour

Stop 1: Test Fixture (fixture.ts) — Context

Well-designed shared infrastructure. Creates fake npm directory layouts in temp dirs, runs the real postinstall.mjs and bin/altimate-code scripts as subprocesses. No network, no credentials, no build step needed. Clean afterEach cleanup via fs.rmSync.

Stop 2: Postinstall Tests — Notice

Covers the happy path (binary found → hard link created), stale replacement, missing package, missing binary file, and wrong-platform scenarios. The noBinDir test nicely documents current behavior (fails when bin/ missing) rather than asserting an ideal.

Stop 3: Bin Wrapper Tests — Notice

Exercises all resolution paths: ALTIMATE_CODE_BIN_PATH env override, cached .altimate-code, sibling node_modules, hoisted parent node_modules, and failure with helpful error. Good coverage of the wrapper's lookup chain.

Stop 4: Integration Tests — Notice

Three tests covering the full pipeline: happy path (layout → postinstall → wrapper), missing optional dep (both fail gracefully), and wrong-platform-only. These are the most valuable tests — they catch the exact class of failure from expired npm tokens.

Stop 5: Publish Package Tests — Notice

Validates package.json structure, naming conventions, and publish.ts patterns by reading the actual source files. These are more like snapshot/contract tests — they'll break if someone changes the publish structure, which is the point.

Summary

Excellent test suite. Purely additive (+519/-0), well-structured with shared fixtures, covers the exact failure class described in the PR (expired npm token → silent optionalDep failure → crash). No issues found. LGTM.