From 88eecb1c71899b861614f110a4de5d0ce9b0bb18 Mon Sep 17 00:00:00 2001 From: Marcos Paulo Date: Sat, 5 Sep 2026 01:22:00 +0000 Subject: [PATCH 1/2] fix: gate the launcher's npm ci on a lockfile, not package.json The pre-existing root package.json has two scripts and no dependencies, and there is no package-lock.json until task 01 scaffolds Astro, so every launch died on `npm ci` before reaching the agent. Co-Authored-By: Claude Opus 5 --- .agents/scripts/launch.sh | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.agents/scripts/launch.sh b/.agents/scripts/launch.sh index bf51c11..61612da 100755 --- a/.agents/scripts/launch.sh +++ b/.agents/scripts/launch.sh @@ -56,9 +56,10 @@ else git worktree add "$dir" -b "$branch" "$base" fi -# npm ci only once task 01 has produced a package.json. Before that there is no -# toolchain to install, and no hooks to verify. -if [ -f "$dir/package.json" ]; then +# npm ci only once task 01 has produced a lockfile. The pre-existing root +# package.json carries two scripts and no dependencies, so before task 01 there +# is no toolchain to install and no hooks to verify. +if [ -f "$dir/package-lock.json" ]; then ( cd "$dir" && npm ci --prefer-offline && .agents/scripts/verify-hooks.sh ) fi From f5631acb2c9f6a5bd54c88cef490155b5dc43d67 Mon Sep 17 00:00:00 2001 From: Marcos Paulo Date: Sat, 5 Sep 2026 02:08:08 +0000 Subject: [PATCH 2/2] fix: say the lockfile is committed, not untouchable AGENTS.md listed package-lock.json under 'Never touch', meaning never hand-edit. Task 01's agent read it as never create, and shipped the scaffold with no lockfile and installs pinned to --package-lock=false. That breaks the parallel worktree setup outright: worktree.sh and launch.sh both spin up with npm ci, which requires a lockfile. Co-Authored-By: Claude Opus 5 --- AGENTS.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index 16f504e..f07fb02 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -49,7 +49,10 @@ Adding a build step changes this contract. Read - `submitted-skills/` — other people's submitted work, reproduced verbatim - `skill-reviews/improved/` — generated; edit `skills-review/catalog.js` instead - `vote-service/` — separate deploy lifecycle; do not fold into the site build -- `package-lock.json`, `dist/`, `node_modules/` +- `dist/`, `node_modules/` — build output, never committed +- `package-lock.json` — **committed, but never hand-edited.** Change it only + as a side effect of `npm install`. Every worktree spins up with `npm ci`, + which fails outright without it. ## Rules