From 0fb7bd64fd7938d13c4bf19ed37e9a4b121f2621 Mon Sep 17 00:00:00 2001
From: default <216188+jdx@users.noreply.github.com>
Date: Sat, 15 Aug 2026 11:58:24 +0000
Subject: [PATCH 1/2] fix: bootstrap aube with npm 11

---
 scripts/setup.sh | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/scripts/setup.sh b/scripts/setup.sh
index f3a32d5aad..84693958e5 100644
--- a/scripts/setup.sh
+++ b/scripts/setup.sh
@@ -57,9 +57,12 @@ npm install -g vite-plus@latest
 npm install --global pnpm@next-12 --prefix /tmp/pnpm12 --allow-scripts=pnpm
 
 # Install aube via npm (available as the `@endevco/aube` package).
+# npm 12 blocks aube's preinstall script, which selects and installs its
+# platform-specific native binary. Bootstrap it with npm 11 until aube's npm
+# package supports npm 12's default-deny lifecycle policy.
 # Non-fatal: aube may not have a working binary for all platforms (e.g. arm64).
 # If it fails to install, the benchmark suite continues without aube.
-if ! npm install -g @endevco/aube@latest; then
+if ! npx --yes npm@11 install -g @endevco/aube@latest; then
   echo "Warning: aube installation failed (may not support this platform) — skipping aube benchmarks"
 fi
 

From 94c44c05fa8403ae6d95014d3775f9d7360cec0d Mon Sep 17 00:00:00 2001
From: default <216188+jdx@users.noreply.github.com>
Date: Sun, 16 Aug 2026 20:54:34 +0000
Subject: [PATCH 2/2] fix: allow aube install scripts with npm 12

---
 scripts/setup.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/scripts/setup.sh b/scripts/setup.sh
index 84693958e5..bb73395051 100644
--- a/scripts/setup.sh
+++ b/scripts/setup.sh
@@ -57,12 +57,12 @@ npm install -g vite-plus@latest
 npm install --global pnpm@next-12 --prefix /tmp/pnpm12 --allow-scripts=pnpm
 
 # Install aube via npm (available as the `@endevco/aube` package).
-# npm 12 blocks aube's preinstall script, which selects and installs its
-# platform-specific native binary. Bootstrap it with npm 11 until aube's npm
-# package supports npm 12's default-deny lifecycle policy.
+# npm 12 blocks dependency lifecycle scripts by default, but aube's preinstall
+# selects and installs its platform-specific native binary. Allow only aube's
+# installer so the binary is available to the benchmark matrix.
 # Non-fatal: aube may not have a working binary for all platforms (e.g. arm64).
 # If it fails to install, the benchmark suite continues without aube.
-if ! npx --yes npm@11 install -g @endevco/aube@latest; then
+if ! npm install -g --allow-scripts=@endevco/aube @endevco/aube@latest; then
   echo "Warning: aube installation failed (may not support this platform) — skipping aube benchmarks"
 fi