mirror of
https://github.com/badlogic/pi-mono.git
synced 2026-11-05 23:37:25 +00:00
5fb9a0b110
`pi install`, `pi remove` and `pi update --extensions` run npm without `--no-audit`, so npm prints its "N vulnerabilities … run `npm audit fix`" advice after every install. pi gives users no way to clear that warning, and following it causes harm. In `~/.pi/agent/npm`, `npm audit fix` runs without `--legacy-peer-deps`, so npm installs the host-provided `@earendil-works/pi-*` peers there: a second copy of pi. The comment above `getNpmInstallArgs` warns against exactly that. The change adds `--no-audit --no-fund` wherever pi already passes `--legacy-peer-deps` to npm: - `getNpmInstallArgs` (npm package installs and updates) - `getGitDependencyInstallArgs` (dependency installs for git packages) - npm uninstall pi's managed self-update (`runManagedNpmCi`) already passes both flags. bun and pnpm arguments are unchanged. I did not edit `CHANGELOG.md`, per CONTRIBUTING.md. **Testing** - Updated the expected npm argument arrays in `test/package-manager.test.ts`. With the source change reverted, 11 tests fail; with it, all 132 pass. - `npm run check` passes. - Ran the built CLI by hand with `PI_CODING_AGENT_DIR=/tmp/pa pi install npm:lodash@4.17.20`: - Before the change, the output ended with npm's "To address all issues, run: npm audit fix" block. - After, it shows only "added 1 package" and "Installed npm:lodash@4.17.20". Fixes #11409 Requested by @badlogic Co-authored-by: triagent <triagent@localhost> |
||
|---|---|---|
| .. | ||
| agent | ||
| ai | ||
| chord | ||
| codemode | ||
| coding-agent | ||
| durable | ||
| env | ||
| evals | ||
| mcp | ||
| telemetry | ||
| tui | ||