fix(install.sh): install moshcode's runtime dependencies after unpacking - #505
Merged
Merged
Conversation
moshcode stopped being dependency-free in 0.96.0 (@profullstack/synconfig), and install.sh unpacks the source tarball and stops, so every install and every `moshcode upgrade` (which runs this script from main) since then produced a CLI that died on its first import: Cannot find package '@profullstack/synconfig' imported from ~/.moshcode/pkg/src/settings-sync.mjs Seen on this box after upgrading to 0.98.0: `moshcode --version` crashed. After the package is in place, read package.json with node (grep would match "devDependencies" too) and, when it lists runtime dependencies, run `npm install --omit=dev` in MOSHCODE_HOME. A missing npm or a failed install fails the install loudly rather than leaving a CLI that cannot start. test/install-deps.test.mjs drives the real install.sh against a tarball built in the test, with curl serving the fixture and npm recording its argv and cwd: dependencies → npm runs in the install dir; devDependencies only → npm is never called; npm fails → the install fails and says why. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014HMV1QDcVY1xiaWWrZQM4S
ThreatCrush Security Scan5 finding(s) in the 2 file(s) this pull request changes. HIGH/CRITICAL: 5
88 pre-existing finding(s) elsewhere in the repository — **HIGH/CRITICAL**: 3 | **MEDIUM**: 75 | **LOW**: 10Not introduced by this pull request. The full set is in the Security tab.
…and 68 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
moshcode stopped being dependency-free in 0.96.0 (
@profullstack/synconfig).install.shunpacks the source tarball and stops, andmoshcode upgraderuns this script from main, so every install and upgrade through it since 0.96.0 produced a CLI that died on its first import:Seen on this box right after upgrading to 0.98.0:
moshcode --versioncrashed.Fix
After the package is in place, read package.json with node (grep would match "devDependencies" too) and, when it lists runtime dependencies, run
npm install --omit=devinMOSHCODE_HOME. A missing npm or a failed install fails the install loudly instead of leaving a CLI that cannot start.Because
moshcode upgradefetchesinstall.shfrom raw main, merging this repairs the upgrade path for everyone immediately; no version bump is needed. The moshcoding.com installer has the same bug and the same fix in moshcoder/moshcoding#116.Verified
test/install-deps.test.mjsdrives the realinstall.shagainst a tarball built in the test, with curl serving the fixture and npm recording its argv and cwd: dependencies →npm install --omit=devruns in the install dir; devDependencies only → npm never called; npm fails → the install fails and says why.sh -n install.shclean; root-guard and upgrade suites still pass.🤖 Generated with Claude Code
https://claude.ai/code/session_014HMV1QDcVY1xiaWWrZQM4S