fix(scripts): read npm pack --json in both npm 10 and npm 12 shapes (#2953) (#2975)

Under npm 12, `npm pack --json` prints an object keyed by package name, so six scripts and tests that read `[0]` failed, including the release pack and the substance gate. A shared reader, `scripts/npm-pack-json.mjs`, accepts both npm 10/11's array and npm 12's object, and all six readers use it; npm 10 and 11 output reads as before. The substance gate binds one package's receipt, so it now refuses pack output that lists more than one package, naming --package-root and any npm workspaces setting, instead of certifying the first entry only. For #2953.

packages/tui/src/hydrate.ts

@@ -287,8 +287,10 @@ function toAgentRow(node: NodeInventoryRead): AgentRow {
             : node.activityState?.display === "idle"
               ? "idle"
               : (node.terminalActive === true || (node.terminalActive == null && node.agentActivity?.state === "running") ? "active"
-                // A community harness gives no idle signal: a quiet screen is unknown, not idle.
-                : node.communityHarness ? "unknown" : "idle"))
+                // The daemon's activity word decides when it's served (as in `rig ps`): it said unknown, so a quiet
+                // screen stays unknown. A community harness gives no idle signal either. Only an older daemon that
+                // serves no activity word keeps the screen fallback.
+                : node.communityHarness || node.activityState ? "unknown" : "idle"))
           : (node.sessionStatus ?? "unknown"),
     live: node.lifecycleState === "running",
     canRun: node.lifecycleState !== "running"

packages/tui/test/hydrate.test.ts

@@ -710,7 +710,7 @@ describe("snapshot hydration over the §4.A reads (Phase 2)", () => {
     expect(output.lines.find((line) => /\bmismatch\s/.test(line))).not.toContain("run ▸");
     expect(output.lines.find((line) => /\bmissing\s/.test(line))).not.toContain("run ▸");
   });
-  it("shows a quiet community harness as unknown, never idle, and leaves built-in rows as they were", async () => {
+  it("shows a quiet seat the daemon reads as unknown as unknown, never idle, for a community harness and a built-in runtime alike", async () => {
     const base = (FIXTURES["/api/rigs/01JRIG/nodes"] as Array<Record<string, unknown>>)[0]!;
     const quiet = { startupStatus: "ready", sessionStatus: "running", terminalActive: false, agentActivity: { state: "unknown" },
       activityState: { activity: "unknown", display: "unknown", needsInput: { count: 0, reason: null }, decidedBy: null } };
@@ -727,8 +727,28 @@ describe("snapshot hydration over the §4.A reads (Phase 2)", () => {
       "dev.app-quiet": "unknown",
       "dev.app-moving": "active",
       "dev.app-prompt": "needs_input",
-      "dev.pi-quiet": "idle",
-      "dev.claude-quiet": "idle",
+      "dev.pi-quiet": "unknown",
+      "dev.claude-quiet": "unknown",
+    });
+  });
+
+  it("keeps the daemon's idle and working words, and the screen fallback only for a daemon that serves no activity word", async () => {
+    const base = (FIXTURES["/api/rigs/01JRIG/nodes"] as Array<Record<string, unknown>>)[0]!;
+    const running = { startupStatus: "ready", sessionStatus: "running", runtime: "claude-code", agentActivity: { state: "unknown" } };
+    const served = (display: string) => ({ activity: display === "idle" ? "idle-at-prompt" : display, display, needsInput: { count: 0, reason: null }, decidedBy: null });
+    const nodes = [
+      { ...base, ...running, logicalId: "dev.served-idle", terminalActive: false, activityState: served("idle") },
+      { ...base, ...running, logicalId: "dev.served-working", terminalActive: false, activityState: served("working") },
+      { ...base, ...running, logicalId: "dev.unknown-moving", terminalActive: true, activityState: served("unknown") },
+      { ...base, ...running, logicalId: "dev.legacy-quiet", terminalActive: false, activityState: undefined },
+    ];
+    const snap = await hydrateSnapshot(fixtureClient({}, { "/api/rigs/01JRIG/nodes": nodes }));
+    const statuses = Object.fromEntries(myrig(snap).pods[0]!.agents.map((agent) => [agent.name, agent.status]));
+    expect(statuses).toEqual({
+      "dev.served-idle": "idle",
+      "dev.served-working": "active",
+      "dev.unknown-moving": "active",
+      "dev.legacy-quiet": "idle",
     });
   });
 

scripts/build-package-assets.test.mjs

@@ -4,6 +4,7 @@ import fs from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { test } from "node:test";
+import { packEntry } from "./npm-pack-json.mjs";
 
 const script = fs.readFileSync(new URL("./build-package.sh", import.meta.url), "utf8");
 const assetsBranch = script.match(/^if \[ -d "\$DAEMON_DIR\/assets" \]; then\n[\s\S]*?^fi$/m)?.[0];
@@ -129,7 +130,7 @@ test("offline npm pack carries staged asset bytes and executability, with npm's
     assertStaged(f);
     const staged = snapshot(f.staged);
     fs.writeFileSync(join(f.cli, "package.json"), JSON.stringify({ name: "openrig-assets-fixture", version: "1.0.0", private: true, files: ["daemon"] }));
-    const packed = JSON.parse(execFileSync("bash", ["-c", 'umask 0022; exec npm pack --offline --ignore-scripts --json --pack-destination "$1"', "asset-pack", f.root], { cwd: f.cli, encoding: "utf8", timeout: 30_000, stdio: ["ignore", "pipe", "pipe"] }))[0];
+    const packed = packEntry(execFileSync("bash", ["-c", 'umask 0022; exec npm pack --offline --ignore-scripts --json --pack-destination "$1"', "asset-pack", f.root], { cwd: f.cli, encoding: "utf8", timeout: 30_000, stdio: ["ignore", "pipe", "pipe"] }));
     const files = new Map(packed.files.map(file => [file.path, file]));
     for (const [name, bytes] of Object.entries(contents)) {
       const entry = `daemon/assets/${name}`;

scripts/check-packing.test.mjs

@@ -2,14 +2,14 @@ import { execSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { test } from "node:test";
 import assert from "node:assert/strict";
+import { packEntry } from "./npm-pack-json.mjs";
 
 test("npm pack of @openrig/cli includes scripts/check-abi.mjs in tarball", () => {
   const output = execSync("npm pack --dry-run --json 2>/dev/null", {
     cwd: "packages/cli",
     encoding: "utf-8",
   });
-  const entries = JSON.parse(output);
-  const files = entries[0]?.files?.map((f) => f.path) ?? [];
+  const files = packEntry(output).files?.map((f) => f.path) ?? [];
 
   assert.ok(
     files.some((f) => f.includes("scripts/check-abi.mjs")),

scripts/check-substance-gate.mjs

@@ -19,6 +19,7 @@ import {
   scanInternalLeaks,
 } from "./internal-leak-scanner.mjs";
 import { LEAK_GUARD_RULES_ENV, leakGuardRulesPath } from "./leak-guard-rules.mjs";
+import { packEntries } from "./npm-pack-json.mjs";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const FIX = "Genericize the content, cite its public home, or re-home it to the internal pack root.";
@@ -155,13 +156,22 @@ function derivePackageArtifacts(packageRoot) {
   if (packed.status !== 0) {
     throw new Error(`npm artifact enumeration failed:\n${packed.stderr || packed.stdout || `exit ${packed.status}`}`);
   }
-  let parsed;
+  let entries = [];
   try {
-    parsed = JSON.parse(packed.stdout);
+    // One parse, in the shared reader: a JSON string (even one holding a serialized list) is not a shape npm prints.
+    entries = packEntries(packed.stdout);
   } catch (error) {
-    throw new Error(`npm artifact enumeration did not return JSON: ${error.message}`);
+    if (error instanceof SyntaxError) throw new Error(`npm artifact enumeration did not return JSON: ${error.message}`);
+    // not a shape npm prints: reported below as no files array
   }
-  const rawFiles = parsed?.[0]?.files;
+  // One package is packed here; scanning only the first of several would issue a receipt for part of the artifact.
+  if (entries.length > 1) {
+    throw new Error(
+      `npm artifact enumeration listed ${entries.length} packages where one was packed; `
+      + "run the gate for one package (check --package-root and any npm workspaces setting)",
+    );
+  }
+  const rawFiles = entries[0]?.files;
   if (!Array.isArray(rawFiles)) throw new Error("npm artifact enumeration returned no files array");
   const files = rawFiles.map((entry) => entry?.path).filter((path) => typeof path === "string");
   if (files.length !== rawFiles.length || files.length === 0) {

scripts/check-substance-gate.test.mjs

@@ -5,6 +5,7 @@ import { execFileSync, spawnSync } from "node:child_process";
 import {
   existsSync,
   mkdirSync,
+  chmodSync,
   mkdtempSync,
   readFileSync,
   rmSync,
@@ -405,6 +406,44 @@ test("exact-line allowances reach content and derived scans and are recorded in
   });
 });
 
+test("npm output that is a JSON string is refused, even when the string holds a serialized list", () => {
+  withFixture(({ root, repo, rules, review, receipt }) => {
+    write(join(repo, "public/guide.md"), "Generic product guidance.\n");
+    commitAll(repo, "string output fixture");
+    writeFileSync(review, JSON.stringify({ surfaces: [] }));
+    const bin = join(root, "bin");
+    const serialized = JSON.stringify([{ files: [{ path: "package.json" }, { path: "public/guide.md" }] }]);
+    write(join(bin, "npm"), `#!${process.execPath}\nprocess.stdout.write(${JSON.stringify(JSON.stringify(serialized))});\n`);
+    chmodSync(join(bin, "npm"), 0o755);
+
+    const result = runGate({ repo, rules, review, receipt, cutSha: gitHead(repo),
+      env: { ...process.env, PATH: `${bin}:${process.env.PATH}` } });
+    assert.notEqual(result.status, 0);
+    assert.match(result.stderr, /npm artifact enumeration returned no files array/);
+  });
+});
+
+test("npm output that lists more than one package is refused before any scan or receipt", () => {
+  const first = { name: "first", files: [{ path: "package.json" }, { path: "public/guide.md" }] };
+  const second = { name: "second", files: [{ path: "package.json" }, { path: "public/other.md" }] };
+  for (const printed of [[first, second], { first, second }]) {
+    withFixture(({ root, repo, rules, review, receipt }) => {
+      write(join(repo, "public/guide.md"), "Generic product guidance.\n");
+      commitAll(repo, "two package output fixture");
+      writeFileSync(review, JSON.stringify({ surfaces: [] }));
+      const bin = join(root, "bin");
+      write(join(bin, "npm"), `#!${process.execPath}\nprocess.stdout.write(${JSON.stringify(JSON.stringify(printed))});\n`);
+      chmodSync(join(bin, "npm"), 0o755);
+
+      const result = runGate({ repo, rules, review, receipt, cutSha: gitHead(repo),
+        env: { ...process.env, PATH: `${bin}:${process.env.PATH}` } });
+      assert.notEqual(result.status, 0);
+      assert.match(result.stderr, /npm artifact enumeration listed 2 packages where one was packed; run the gate for one package \(check --package-root and any npm workspaces setting\)/);
+      assert.equal(existsSync(receipt), false);
+    });
+  }
+});
+
 test("the release ceremony names the gate and its durable receipt", () => {
   const pkg = JSON.parse(readFileSync("package.json", "utf8"));
   assert.equal(pkg.scripts["gate:substance"], "node scripts/check-substance-gate.mjs");
@@ -420,7 +459,7 @@ function writeGateHarness(root, source, invocationPath) {
   mkdirSync(root, { recursive: true });
   const gate = join(root, "check-substance-gate.mjs");
   writeFileSync(gate, source);
-  for (const module of ["internal-leak-scanner.mjs", "leak-guard-rules.mjs"]) {
+  for (const module of ["internal-leak-scanner.mjs", "leak-guard-rules.mjs", "npm-pack-json.mjs"]) {
     writeFileSync(join(root, module), readFileSync(resolve("scripts", module)));
   }
   writeFileSync(join(root, "check-internal-leak-guard.mjs"), [
@@ -474,7 +513,7 @@ function withFixture(run) {
   }
 }
 
-function runGate({ repo, rules, review, receipt, cutSha, gate = GATE }) {
+function runGate({ repo, rules, review, receipt, cutSha, gate = GATE, env = process.env }) {
   return spawnSync(process.execPath, [
     gate,
     "--repo", repo,
@@ -485,7 +524,7 @@ function runGate({ repo, rules, review, receipt, cutSha, gate = GATE }) {
     "--receipt", receipt,
     "--judge", "dev-qa@fixture",
     "--cut-sha", cutSha,
-  ], { encoding: "utf8" });
+  ], { encoding: "utf8", env });
 }
 
 function write(path, content) {

scripts/cli-license.test.mjs

@@ -4,6 +4,7 @@ import { tmpdir } from "node:os";
 import { delimiter, join } from "node:path";
 import { test } from "node:test";
 import assert from "node:assert/strict";
+import { packEntry } from "./npm-pack-json.mjs";
 
 test("the CLI build carries the unchanged repository LICENSE and README into npm pack", () => {
   const root = mkdtempSync(join(tmpdir(), "cli-license-"));
@@ -26,14 +27,14 @@ test("the CLI build carries the unchanged repository LICENSE and README into npm
     execFileSync("npm", ["run", "build"], { cwd: cli, env, stdio: "pipe" });
     const source = readFileSync(join(root, "LICENSE"));
     assert.deepEqual(readFileSync(join(cli, "LICENSE")), source, "build must stage the repository license verbatim");
-    const packed = JSON.parse(execFileSync("npm", ["pack", "--ignore-scripts", "--json"], { cwd: cli, env, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }));
-    assert.ok(packed[0].files.some((file) => file.path === "LICENSE"), "npm archive must include LICENSE");
-    const bytes = execFileSync("tar", ["-xOf", join(cli, packed[0].filename), "package/LICENSE"]);
+    const packed = packEntry(execFileSync("npm", ["pack", "--ignore-scripts", "--json"], { cwd: cli, env, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }));
+    assert.ok(packed.files.some((file) => file.path === "LICENSE"), "npm archive must include LICENSE");
+    const bytes = execFileSync("tar", ["-xOf", join(cli, packed.filename), "package/LICENSE"]);
     assert.deepEqual(bytes, source, "packed license must equal the existing root bytes");
     // npm shows the package-root README on the registry page; without it the page reads "No README data found".
     const readme = readFileSync(join(root, "README.md"));
-    assert.ok(packed[0].files.some((file) => file.path === "README.md"), "npm archive must include README.md");
-    const readmeBytes = execFileSync("tar", ["-xOf", join(cli, packed[0].filename), "package/README.md"]);
+    assert.ok(packed.files.some((file) => file.path === "README.md"), "npm archive must include README.md");
+    const readmeBytes = execFileSync("tar", ["-xOf", join(cli, packed.filename), "package/README.md"]);
     assert.deepEqual(readmeBytes, readme, "packed README must equal the existing root bytes");
   } finally {
     rmSync(root, { recursive: true, force: true });

scripts/npm-pack-json.mjs

@@ -0,0 +1,25 @@
+// `npm pack --json` prints an array of entries up to npm 11 and, from npm 12, an object keyed by package name
+// ("the --json output of `npm pack` and `npm publish` have changed",
+// https://github.com/npm/cli/releases/tag/v12.0.0). Every reader of that output goes through here, so both shapes
+// give the same entries.
+
+/** The entries `npm pack --json` printed, in order, from its output text or its parsed value. */
+export function packEntries(output) {
+  const parsed = typeof output === "string" ? JSON.parse(output) : output;
+  const entries = Array.isArray(parsed)
+    ? parsed
+    : parsed !== null && typeof parsed === "object" ? Object.values(parsed) : null;
+  if (!entries || !entries.every((entry) => entry !== null && typeof entry === "object" && !Array.isArray(entry))) {
+    throw new Error("npm pack --json printed neither an array of entries nor an object of per-package entries");
+  }
+  return entries;
+}
+
+/** The one entry of a `npm pack --json` run that packed one package; any other count throws. */
+export function packEntry(output) {
+  const entries = packEntries(output);
+  if (entries.length !== 1) {
+    throw new Error(`npm pack --json printed ${entries.length} entries where one package was packed`);
+  }
+  return entries[0];
+}

scripts/npm-pack-json.test.mjs

@@ -0,0 +1,35 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { packEntries, packEntry } from "./npm-pack-json.mjs";
+
+const entry = { id: "@openrig/[email protected]", name: "@openrig/cli", version: "1.2.3", filename: "openrig-cli-1.2.3.tgz",
+  files: [{ path: "LICENSE" }, { path: "package.json" }] };
+
+test("npm 10 and 11: an array of entries", () => {
+  assert.deepEqual(packEntries(JSON.stringify([entry])), [entry]);
+  assert.deepEqual(packEntry(JSON.stringify([entry])), entry);
+});
+
+test("npm 12: an object of entries keyed by package name", () => {
+  assert.deepEqual(packEntries(JSON.stringify({ "@openrig/cli": entry })), [entry]);
+  assert.deepEqual(packEntry(JSON.stringify({ "@openrig/cli": entry })), entry);
+});
+
+test("both shapes keep every entry in order, and a parsed value reads like its text", () => {
+  const other = { ...entry, name: "@openrig/acp", filename: "openrig-acp-1.2.3.tgz" };
+  assert.deepEqual(packEntries([entry, other]), [entry, other]);
+  assert.deepEqual(packEntries({ "@openrig/cli": entry, "@openrig/acp": other }), [entry, other]);
+});
+
+test("packEntry refuses any count but one", () => {
+  assert.throws(() => packEntry("[]"), /0 entries/);
+  assert.throws(() => packEntry("{}"), /0 entries/);
+  assert.throws(() => packEntry(JSON.stringify([entry, entry])), /2 entries/);
+});
+
+test("output that is neither shape throws", () => {
+  for (const output of ["null", "\"text\"", "3", JSON.stringify(entry), JSON.stringify([[entry]]), JSON.stringify({ a: null })]) {
+    assert.throws(() => packEntries(output), /neither an array of entries nor an object of per-package entries/, output);
+  }
+  assert.throws(() => packEntries("not json"), SyntaxError);
+});

scripts/pack-release.mjs

@@ -8,6 +8,7 @@ import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { packEntry } from './npm-pack-json.mjs';
 
 const LISTING = ['packages/acp/registry/agent.json', 'packages/acp/registry/icon.svg'];
 const readJson = (root, rel) => JSON.parse(readFileSync(join(root, rel), 'utf8'));
@@ -35,8 +36,8 @@ export function packRelease(root, dest) {
   mkdirSync(dest, { recursive: true });
   // The CLI is packed as the release producer has packed it; the launcher isn't a workspace, so it's packed by path.
   // --ignore-scripts skips pack's prepack and postpack, but npm 10 still runs a `prepare`; neither package has one.
-  const pack = target => JSON.parse(execFileSync('npm', ['pack', ...target, '--ignore-scripts', '--json', '--pack-destination', dest],
-    { cwd: root, encoding: 'utf8' }))[0];
+  const pack = target => packEntry(execFileSync('npm', ['pack', ...target, '--ignore-scripts', '--json', '--pack-destination', dest],
+    { cwd: root, encoding: 'utf8' }));
   const artifacts = [pack(['--workspace', 'packages/cli']), pack(['./packages/acp'])].map(packed => {
     const path = join(dest, packed.filename);
     return { name: packed.name, version: packed.version, path, size: packed.size, sha256: sha256(path), integrity: packed.integrity };

scripts/test-tui-package.mjs

@@ -4,6 +4,7 @@ import os from "node:os";
 import path from "node:path";
 import { execFileSync, spawn, spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
+import { packEntry } from "./npm-pack-json.mjs";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const cli = path.join(root, "packages", "cli");
@@ -47,8 +48,8 @@ async function assertDelayedSplits(entry, pkgDir) {
 
 try {
   execFileSync("npm", ["run", "build:package"], { cwd: root, stdio: "inherit" });
-  const packed = JSON.parse(execFileSync("npm", ["pack", "--ignore-scripts", "--json", "--pack-destination", temp], { cwd: cli, encoding: "utf8" }));
-  const tarball = path.join(temp, packed[0].filename);
+  const packed = packEntry(execFileSync("npm", ["pack", "--ignore-scripts", "--json", "--pack-destination", temp], { cwd: cli, encoding: "utf8" }));
+  const tarball = path.join(temp, packed.filename);
   execFileSync("tar", ["-xzf", tarball, "-C", temp]);
 
   const pkgDir = path.join(temp, "package");
@@ -68,7 +69,7 @@ try {
   });
   assert.equal(launched.status, 0, launched.stderr || `packed TUI exited ${launched.status}`);
   await assertDelayedSplits(entry, pkgDir);
-  console.log(`packed TUI launch PASS: ${packed[0].filename}`);
+  console.log(`packed TUI launch PASS: ${packed.filename}`);
 } finally {
   fs.rmSync(temp, { recursive: true, force: true });
 }