Same failure shape as #1147: `npx @claude-flow/cli@latest` crashes with
`npm error Invalid Version: ` on npm 11.x / Node 24+.
Root cause: @claude-flow/embeddings declared @huggingface/transformers in
both `optionalDependencies` AND `peerDependencies` (with
peerDependenciesMeta.optional = true). When npm 11.x arborist runs
PlaceDep.pruneDedupable → Node.canDedupe → semver.eq, the overlap plus a
"-dev." prerelease transitive (onnxruntime-web@1.26.0-dev.…) trips the
empty-version crash inside @npmcli/arborist.
Fix:
- @claude-flow/embeddings: keep only the optional peerDependency, drop
the duplicate optionalDependencies entry. Bumped to 3.0.0-alpha.17.
- @claude-flow/cli: pin embeddings to ^3.0.0-alpha.17 so existing
lockfiles re-resolve to the fixed version. Bumped to 3.7.0-alpha.39.
Regression guards (so this can't recur):
- scripts/audit-package-dep-overlap.mjs — static check that no package
declares the same name in BOTH optionalDependencies and
peerDependencies. Wired into v3-ci.yml as part of the
plugin-package-audit job.
- scripts/smoke-cli-npx-install.mjs — behavioural smoke: pack the CLI
tarball, install it into a scratch project with optionals enabled,
fail if `npm install` prints "Invalid Version:" or exits non-zero.
New v3-ci.yml job `cli-npx-install-smoke` runs on Node 22 + 24
(Node 24 ships npm 11.x, where the bug surfaces) and gates witness-verify.
Verified end-to-end:
$ npx -y @claude-flow/cli@3.7.0-alpha.39 doctor
✓ MCP Servers, AIDefence, Disk Space, TypeScript … 10 passed
Reuven