fix(installer): support npm 12 remote dependency policy

[sethkarten]

Summary

• pass --allow-remote=all only to the checksum-verified installer command under npm 12 or newer
• cover npm 10.9.8, npm 11.12.1, and npm 12.0.2 installer behavior without changing older npm commands
• smoke-test a locally packed release through the real installer under npm 12 in the release workflow
• add a coding-agent changelog fragment

Security

npm 12's narrower allow-remote=root policy still rejects the current release graph because the R2 tarballs are non-root dependencies. The installer therefore uses all, but only for its controlled global install command after verifying the downloaded root tarball against SHA256SUMS. It does not change user or global npm configuration.

No-Ticket: The immediate report is public Discussion #1988, not a Research ticket.

This is a compatibility fix for the current R2 release format. ENG-4686 tracks the longer-term move away from R2 URL dependencies.

Validation

• npm run check:installer
• npm run check
• isolated real install of the verified v0.9.1 tarball with npm 12.0.2, NPM_CONFIG_IGNORE_SCRIPTS=true, and a temporary global prefix

Reported in Discussion #1988.

Note

Fix install.sh to add remote dependency policy flags for npm 12+

• Adds prime_agent_npm_requires_remote_policy to parse the active npm version and return success only for major version 12 or newer
• Adds prime_agent_npm_install wrapper that preserves existing quiet/audit/funding options and, for npm 12+, permits remote dependencies and tarball-specific lifecycle scripts; older npm versions use the prior argument set
• Both bootstrap-enabled and bootstrap-disabled branches of install_prime_agent_package now call this wrapper instead of invoking npm install directly
• Renames scripts/check-installer-render.mjs to scripts/check-installer.mjs, adds a checkNpmInstallPolicies test that verifies no overrides for npm 10/11 and correct overrides for npm 12, and updates the check:installer script accordingly
• Adds a CI smoke-test step in the release workflow that installs npm 12.0.2, serves release artifacts over localhost, runs the installer, and asserts the command is executable
• Risk: prime_agent_npm_install passes --allow-scripts scoped to the verified tarball for npm 12+; if npm changes flag behavior or the tarball name does not match, global install may fail or scripts may not run

^{Macroscope summarized 3498b0e.}

---

Note

Medium Risk
The installer widens npm 12 remote/script allowances for a single verified global install command; scope is limited but touches release install security policy.

Overview
Fixes stable installs failing on npm 12 when the verified release graph pulls non-root R2 tarball dependencies.

install.sh now routes global installs through prime_agent_npm_install, which detects npm major ≥ 12 and adds --allow-remote=all plus --allow-scripts scoped to the checksum-verified root tarball; npm 10/11 keep the previous npm install -g flags.

CI and local checks were extended: the release workflow smoke-tests a packed stable release served locally under npm 12.0.2, and check-installer.mjs asserts install flag behavior for simulated npm 10.9.8, 11.12.1, and 12.0.2 (the check:installer script entry was updated accordingly). A coding-agent changelog fragment documents the fix for Discussion #1988.

^{Reviewed by Cursor Bugbot for commit 3498b0e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1d25a60. Configure here.}