chore: harden dependency workflows

scripts/build-binaries.sh

@@ -57,7 +57,7 @@ if [[ -n "$PLATFORM" ]]; then
 fi
 
 echo "==> Installing dependencies..."
-npm ci
+npm ci --ignore-scripts
 
 if [[ "$SKIP_DEPS" == "false" ]]; then
     echo "==> Installing cross-platform native bindings..."

scripts/check-lockfile-commit.mjs

@@ -0,0 +1,94 @@
+#!/usr/bin/env node
+
+import { execFileSync } from "node:child_process";
+
+const allowValue = process.env.PI_ALLOW_LOCKFILE_CHANGE;
+const allowed = allowValue === "1" || allowValue === "true" || allowValue === "yes";
+
+function git(args) {
+	return execFileSync("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+}
+
+function readJsonFromGit(ref) {
+	try {
+		return JSON.parse(git(["show", ref]));
+	} catch {
+		return undefined;
+	}
+}
+
+function packageNameFromLockPath(lockPath) {
+	const marker = "node_modules/";
+	const index = lockPath.lastIndexOf(marker);
+	if (index === -1) return lockPath || "<root>";
+	const parts = lockPath.slice(index + marker.length).split("/");
+	return parts[0]?.startsWith("@") ? `${parts[0]}/${parts[1]}` : parts[0];
+}
+
+function packageLabel(lockPath, entry) {
+	const name = entry?.name ?? packageNameFromLockPath(lockPath);
+	return entry?.version ? `${name}@${entry.version}` : name;
+}
+
+function summarizeLockfileChange() {
+	const before = readJsonFromGit("HEAD:package-lock.json");
+	const after = readJsonFromGit(":package-lock.json");
+	if (!before?.packages || !after?.packages) return [];
+
+	const changes = [];
+	const paths = new Set([...Object.keys(before.packages), ...Object.keys(after.packages)]);
+	for (const lockPath of [...paths].sort()) {
+		if (!lockPath.includes("node_modules/")) continue;
+		const oldEntry = before.packages[lockPath];
+		const newEntry = after.packages[lockPath];
+		if (!oldEntry && newEntry) {
+			changes.push(`added ${packageLabel(lockPath, newEntry)}`);
+		} else if (oldEntry && !newEntry) {
+			changes.push(`removed ${packageLabel(lockPath, oldEntry)}`);
+		} else if (oldEntry?.version !== newEntry?.version) {
+			changes.push(
+				`changed ${packageNameFromLockPath(lockPath)} ${oldEntry?.version ?? "<none>"} -> ${newEntry?.version ?? "<none>"}`,
+			);
+		}
+	}
+	return changes;
+}
+
+const stagedFiles = git(["diff", "--cached", "--name-only"])
+	.split("\n")
+	.map((line) => line.trim())
+	.filter(Boolean);
+
+if (!stagedFiles.includes("package-lock.json")) {
+	process.exit(0);
+}
+
+if (allowed) {
+	console.error("package-lock.json is staged; PI_ALLOW_LOCKFILE_CHANGE is set, allowing commit.");
+	process.exit(0);
+}
+
+console.error("package-lock.json is staged.");
+console.error("");
+console.error("Review lockfile changes before committing:");
+console.error("  - confirm every new/updated package is intentional");
+console.error("  - confirm npm age gates were active for resolution");
+console.error("  - review any new lifecycle scripts in the dependency tree");
+console.error("  - regenerate/check coding-agent shrinkwrap if release deps changed");
+
+const changes = summarizeLockfileChange();
+if (changes.length > 0) {
+	console.error("");
+	console.error("Detected package version changes:");
+	for (const change of changes.slice(0, 40)) {
+		console.error(`  - ${change}`);
+	}
+	if (changes.length > 40) {
+		console.error(`  ... ${changes.length - 40} more`);
+	}
+}
+
+console.error("");
+console.error("If this lockfile change is intentional, commit with:");
+console.error("  PI_ALLOW_LOCKFILE_CHANGE=1 git commit ...");
+process.exit(1);

scripts/generate-coding-agent-shrinkwrap.mjs

@@ -10,6 +10,11 @@ const codingAgentDir = join(repoRoot, "packages/coding-agent");
 const rootLockfilePath = join(repoRoot, "package-lock.json");
 const shrinkwrapPath = join(codingAgentDir, "npm-shrinkwrap.json");
 const internalPackagePrefix = "@earendil-works/pi-";
+const allowedInstallScriptPackages = new Map([
+	["@google/genai@1.52.0", "preinstall is a no-op in the published package"],
+	["koffi@2.16.2", "optional native package ships prebuilt modules used without install scripts"],
+	["protobufjs@7.5.9", "postinstall only warns about protobufjs version scheme mismatches"],
+]);
 
 const args = new Set(process.argv.slice(2));
 const checkOnly = args.has("--check");
@@ -221,6 +226,7 @@ function validateShrinkwrap(shrinkwrap, internalNames) {
 	const errors = [];
 	const includedPaths = new Set(Object.keys(shrinkwrap.packages));
 	const includedPackageNames = new Set();
+	const seenAllowedInstallScriptPackages = new Set();
 
 	for (const [lockPath, entry] of Object.entries(shrinkwrap.packages)) {
 		const packageName = packageNameFromLockPath(lockPath);
@@ -233,6 +239,26 @@ function validateShrinkwrap(shrinkwrap, internalNames) {
 		if (typeof entry.resolved === "string" && /^(file:|link:|workspace:|\.\.?\/|\/)/.test(entry.resolved)) {
 			errors.push(`${lockPath} has a local resolved value: ${entry.resolved}`);
 		}
+		if (entry.hasInstallScript) {
+			if (!packageName || !entry.version) {
+				errors.push(`${lockPath || "root"} has install scripts but no package name/version`);
+			} else {
+				const packageId = `${packageName}@${entry.version}`;
+				if (allowedInstallScriptPackages.has(packageId)) {
+					seenAllowedInstallScriptPackages.add(packageId);
+				} else {
+					errors.push(
+						`${lockPath} has install scripts (${packageId}). Review it and add it to allowedInstallScriptPackages if intentional.`,
+					);
+				}
+			}
+		}
+	}
+
+	for (const packageId of allowedInstallScriptPackages.keys()) {
+		if (!seenAllowedInstallScriptPackages.has(packageId)) {
+			errors.push(`allowed install-script package ${packageId} is no longer present; remove it from the allowlist`);
+		}
 	}
 
 	for (const name of internalNames) {

scripts/local-release.mjs

@@ -167,7 +167,7 @@ if (!options.skipInstall) {
 		`${JSON.stringify({ private: true, dependencies }, undefined, "\t")}\n`,
 	);
 
-	run("npm", ["install", "--omit=dev"], { cwd: installDirectory });
+	run("npm", ["install", "--omit=dev", "--ignore-scripts"], { cwd: installDirectory });
 	mkdirSync(binDirectory, { recursive: true });
 	symlinkSync(join(installDirectory, "node_modules", ".bin", "pi"), join(binDirectory, "pi"));
 }