Reuven 1430b4c76e fix(embeddings): #2018 — drop @huggingface/transformers from optionalDependencies (npx Invalid Version) ...

Same failure shape as #1147: `npx @claude-flow/cli@latest` crashes with
`npm error Invalid Version: ` on npm 11.x / Node 24+.

Root cause: @claude-flow/embeddings declared @huggingface/transformers in
both `optionalDependencies` AND `peerDependencies` (with
peerDependenciesMeta.optional = true). When npm 11.x arborist runs
PlaceDep.pruneDedupable → Node.canDedupe → semver.eq, the overlap plus a
"-dev." prerelease transitive (onnxruntime-web@1.26.0-dev.…) trips the
empty-version crash inside @npmcli/arborist.

Fix:
- @claude-flow/embeddings: keep only the optional peerDependency, drop
  the duplicate optionalDependencies entry. Bumped to 3.0.0-alpha.17.
- @claude-flow/cli: pin embeddings to ^3.0.0-alpha.17 so existing
  lockfiles re-resolve to the fixed version. Bumped to 3.7.0-alpha.39.

Regression guards (so this can't recur):
- scripts/audit-package-dep-overlap.mjs — static check that no package
  declares the same name in BOTH optionalDependencies and
  peerDependencies. Wired into v3-ci.yml as part of the
  plugin-package-audit job.
- scripts/smoke-cli-npx-install.mjs — behavioural smoke: pack the CLI
  tarball, install it into a scratch project with optionals enabled,
  fail if `npm install` prints "Invalid Version:" or exits non-zero.
  New v3-ci.yml job `cli-npx-install-smoke` runs on Node 22 + 24
  (Node 24 ships npm 11.x, where the bug surfaces) and gates witness-verify.

Verified end-to-end:
  $ npx -y @claude-flow/cli@3.7.0-alpha.39 doctor
  ✓ MCP Servers, AIDefence, Disk Space, TypeScript … 10 passed

2026-05-15 21:44:39 -04:00

5.3 KiB

Raw Permalink Blame History

View Raw