Skip to content

chore: test dependency installation canary#10

Open
pullfrog[bot] wants to merge 45 commits intomainfrom
pullfrog/test-dep-install-canary
Open

chore: test dependency installation canary#10
pullfrog[bot] wants to merge 45 commits intomainfrom
pullfrog/test-dep-install-canary

Conversation

@pullfrog
Copy link
Copy Markdown

@pullfrog pullfrog Bot commented Apr 4, 2026

Temporary PR created to preserve working tree changes from a dependency installation test run.

The package.json was modified as part of testing postinstall script execution behavior — specifically, whether npm ci --ignore-scripts suppresses lifecycle scripts (it does).

Pullfrog  | Triggered by Pullfrog | Using Claude Opus𝕏


Note

Medium Risk
Adds a postinstall lifecycle script that writes to /tmp, which can have unexpected side effects during installs/CI even though it’s simple and temporary.

Overview
Updates package.json to rename the package and add a postinstall canary that writes CANARY_MARKER to /tmp/postinstall-canary.txt during dependency installation.

Also removes private/type settings and the vitest test script, and adds an explicit empty dependencies block with a new version field.

Reviewed by Cursor Bugbot for commit 5fba7ed. Bugbot is set up for automated code reviews on this repo. Configure here.

pullfrog Bot added 30 commits April 4, 2026 20:50
Copy link
Copy Markdown

@cursor cursor Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 677be62. Configure here.

Comment thread package.json
}
"postinstall": "echo CANARY_MARKER > /tmp/postinstall-canary.txt"
},
"dependencies": {}
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Test debugging changes accidentally committed to package.json

High Severity

The entire package.json has been replaced with a temporary test configuration. The postinstall script writing a canary marker to /tmp is a debugging artifact. The removal of "private": true risks accidental npm publication, the removal of "type": "module" can break ESM resolution, and the removal of the "test": "vitest run" script breaks the existing test suite in test/math.test.ts. The PR description itself confirms these are temporary working tree changes from a test run.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 677be62. Configure here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants