test: write package.json for dependency install canary test

[pullfrog]

This PR captures the package.json change made during a dependency installation behavior test. The file was overwritten as part of the test task to verify postinstall script execution via start_dependency_installation / await_dependency_installation.

  ^{｜ Triggered by Pullfrog ｜ Using Claude Opus ｜ 𝕏}

---

Note

Medium Risk
Adds a postinstall script that writes to /tmp, which will execute on dependency installs and could affect CI environments. Otherwise changes are limited to package metadata and a minimal package-lock.json.

Overview
Adjusts package.json to act as a dependency-install canary by renaming the package and adding a postinstall script that writes CANARY_MARKER to /tmp/postinstall-canary.txt.

Adds a minimal package-lock.json (lockfile v3) to capture the npm install state for this test setup.

^{Reviewed by Cursor Bugbot for commit c2aec6c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Test package.json overwrites real project configuration

High Severity

The root package.json appears to have been overwritten with a canary-test-only version. This removes "private": true (risking accidental npm publish), "type": "module" (breaking existing ES module imports in src/ and test/), and the "test": "vitest run" script (breaking npm test). The existing test/math.test.ts imports from vitest and uses ES module syntax, which will no longer work. Per the PR description, this file was "overwritten as part of the test task" — it looks like a test artifact that was accidentally committed.

 

^{Reviewed by Cursor Bugbot for commit ab76b76. Configure here.}

[cursor]

Package name mismatch between lockfile and manifest

Medium Severity

The package-lock.json uses "name": "test-repo" (in both the root and the packages[""] entry) while package.json was changed to "name": "test-pkg". This mismatch means npm will detect an inconsistency and may regenerate the lockfile on install, which could interfere with the deterministic behavior expected by the canary test.

Additional Locations (1)

• package.json#L1-L2

 

^{Reviewed by Cursor Bugbot for commit 17fb087. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 3 total unresolved issues (including 2 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 767a1ad. Configure here.}

[cursor]

Name mismatch between package.json and package-lock.json

Medium Severity

The package.json declares "name": "test-pkg" while the new package-lock.json declares "name": "test-repo". This mismatch causes npm to emit warnings and may lead to unexpected behavior during dependency installation—the very operation this canary test is meant to verify.

Additional Locations (1)

• package-lock.json#L1-L2

 

^{Reviewed by Cursor Bugbot for commit 767a1ad. Configure here.}