fix(cli): avoid creating app router during postinstall

[yart]

Summary

• skip standalone-only postinstall helper sync when the published app/server.js bundle is absent
• prevent source checkouts from creating a fake root app/ directory during npm install
• ship the new helper inside the npm artifact and cover the guard with targeted unit tests

Problem

3.6.6 introduced a startup regression in source checkouts:

1. scripts/postinstall.mjs can create app/node_modules/... at the repository root while trying to sync standalone-only runtime helpers.
2. scripts/run-next.mjs treats any root-level app/ directory as a fatal App Router conflict because the real application lives under src/app/.
3. After a normal npm install, npm start may abort before the server boots, even though the checkout itself is otherwise healthy.

In practice this means a source checkout can fail to start only because postinstall materialized a standalone runtime directory that does not belong in development/source mode.

Why this fix

The standalone helper sync is only valid for the published npm artifact, where app/server.js exists.
In a source checkout there is no standalone app bundle, so creating app/ is both unnecessary and harmful.

This fix adds a small guard that only enables the standalone-specific postinstall behavior when the published standalone bundle is actually present.
That keeps npm package installs working while preventing source checkouts from poisoning themselves with a fake App Router root.

Testing

• node --import tsx/esm --test tests/unit/postinstall-support.test.ts tests/unit/pack-artifact-policy.test.ts
• npm run build
• rm -rf app && node scripts/postinstall.mjs && test ! -e app

Changed or added test files:

• tests/unit/postinstall-support.test.ts
• tests/unit/pack-artifact-policy.test.ts

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[yart]

Local repro from a clean Linux source checkout:

1. Fresh clone the repository.
2. Run

omniroute@3.6.7 postinstall
node scripts/postinstall.mjs

omniroute@3.6.7 prepare
husky

up to date, audited 1331 packages in 2s

412 packages are looking for funding
run npm fund for details

found 0 vulnerabilities.
3. Observe that materializes a root-level directory ().
4. Run the normal startup path (

omniroute@3.6.7 start
node scripts/run-next.mjs start / ).

5. Startup aborts because detects both and a root and treats that as a fatal App Router conflict.

I hit this after a clean reclone, so this was reproducible without any old local junk in the worktree.

The key point is that the source checkout does not actually contain a published standalone bundle (), so the standalone-specific postinstall sync should be skipped entirely in that environment.

[yart]

Clean reproduction from a real Linux source checkout:

1. Fresh-clone the repository.
2. Run npm install.
3. postinstall creates a root app/ directory with app/node_modules/... even though the source checkout does not ship a published standalone bundle.
4. Run the normal startup path.
5. startup aborts because run-next.mjs sees both src/app and root app and treats that as a fatal App Router conflict.

I reproduced this after a clean reclone, so it was not caused by stale local junk in the worktree.

The core issue is that standalone-only postinstall behavior is being applied in a source checkout where no published standalone app bundle exists.

[diegosouzapw]

Thanks @yart for this great contribution! 🎉 The development environment postinstall fix has been integrated into the release/v3.6.8 branch and will be part of the next release. We appreciate your effort protecting the source checkouts from fake App Router roots!