chore(deps): approve npm install scripts and fix doctor staleness warns - #782

#!/bin/bash
set -euo pipefail

echo "Files:"
git ls-files | rg '(^|/)(package\.json|package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb|CONTRIBUTING\.md)$|\.github/CONTRIBUTING\.md'

echo
echo "Package manager files and relevant package manager config:"
for f in package.json package-lock.json pnpm-lock.yaml yarn.lock bun.lockb .github/CONTRIBUTING.md; do
  if [ -f "$f" ]; then
    echo "--- $f ---"
    case "$f" in
      package.json) sed -n '1,220p' "$f" ;;
      CONTRIBUTING.md|.github/CONTRIBUTING.md) sed -n '1,140p' "$f" ;;
      *) sed -n '1,80p' "$f" ;;
    esac
  fi
done

echo
echo "Search for npm/ci/install/workspace docs:"
rg -n "npm (ci|install)|lockfile|workspace|restore|dependencies|pnpm|yarn|bun" . -g '!node_modules' -g '!dist' -g '!build' | head -n 200

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
import json, subprocess
from pathlib import Path

package_path = Path("package.json")
contrib_path = Path(".github/CONTRIBUTING.md")
lock_paths = [Path("package-lock.json"), Path("npm-shrinkwrap.json"), Path("pnpm-lock.yaml"), Path("yarn.lock"), Path("bun.lockb")]

print("package_json_exists:", package_path.exists())
if package_path.exists():
    data = json.loads(package_path.read_text())
    print("package_engines_node:", data.get("engines", {}).get("node"))
    print("package_workspaces:", data.get("workspaces"))
    print("package_scripts_dev_frontend:", data.get("scripts", {}).get("dev"))
    print("package_scripts_dev_workspace:", data.get("scripts", {}).get("dev --workspace frontend"))
    print("frontend_package_exists:", (package_path.parent / "frontend" / "package.json").exists())
    ff = package_path.parent / "frontend" / "package.json"
    if ff.exists():
        fd = json.loads(ff.read_text())
        print("frontend_package_name:", fd.get("name"))
        print("frontend_package_dev_script:", fd.get("scripts", {}).get("dev"))

print("lockfile_exists:", {str(p): p.exists() for p in lock_paths})

contrib_text = contrib_path.read_text() if contrib_path.exists() else ""
for needle in ["npm install", "npm ci", "npm update", "npm run dev --workspace frontend", "lockfile"]:
    print(f"contrib_contains_{needle!r}:", needle in contrib_text)

# npm semantics check: if npm package manager is present and the npm version is semver-compatible enough,
# ask npm to document lockfile-backed install command without mutating repository files.
try:
    res = subprocess.run(["npm", "config", "get", "update-notifier"], stdout=subprocess.PIPE, stderr=subprocess.PIPE, check=True, text=True, timeout=20)
    npm_exists = True
except Exception as e:
    npm_exists = False
print("npm_exists:", npm_exists)
if npm_exists:
    print("npm_config_update-notifier:", res.stdout.strip())
PY

#!/bin/bash
set -euo pipefail

printf '--- CONTRIBUTING relevant lines ---\n'
sed -n '160,190p' .github/CONTRIBUTING.md 2>/dev/null || true

printf '\n--- package.json files ---\n'
git ls-files '*package.json' | sed -n '1,50p'

printf '\n--- root package.json allowScripts/workspaces ---\n'
python3 - <<'PY'
import json
with open('package.json') as f:
    data=json.load(f)
print('workspaces:', data.get('workspaces'))
print('allowScripts:', data.get('allowScripts'))
PY

printf '\n--- npm install-scripts references ---\n'
rg -n "install-scripts|allowScripts" -S . --glob '!node_modules/**' --glob '!dist/**' --glob '!build/**'

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- CONTRIBUTING relevant lines ---'
sed -n '160,190p' .github/CONTRIBUTING.md 2>/dev/null || true

printf '%s\n' ''
printf '%s\n' '--- package.json files ---'
git ls-files '*package.json' | sed -n '1,50p'

printf '%s\n' ''
printf '%s\n' '--- root package.json allowScripts/workspaces ---'
python3 - <<'PY'
import json
with open('package.json') as f:
    data=json.load(f)
print('workspaces:', data.get('workspaces'))
print('allowScripts:', data.get('allowScripts'))
PY

printf '%s\n' ''
printf '%s\n' '--- npm install-scripts references ---'
rg -n "install-scripts|allowScripts" -S . --glob '!node_modules/**' --glob '!dist/**' --glob '!build/**'