Two independent fixes: 1. strands package-lock.json was invalid JSON. Commit 00ce3a9 on main ("chore: ratchet showcase baseline to 95 + sync strands lockfile", May 19) produced a lockfile with trailing commas before closing braces — Node's V8 JSON parser (which npm uses internally) rejects it as "Expected double-quoted property name in JSON at position 1042" the moment `npm ci` tries to read it. npm surfaces this as "command can only install with an existing package-lock.json with lockfileVersion >= 1", which is misleading — the lockfile exists and declares lockfileVersion: 3, but it fails to parse before npm gets that far. The first strands `Showcase: Build & Push` run on main after that commit (2026-05-19T20:57:40Z) failed for the same reason; main's strands check has been broken since, but B&P runs are gated by paths-filter so subsequent commits that didn't touch `showcase/integrations/strands/**` simply skipped the strands job instead of failing. Our PR's `Showcase: Build Check (PR)` matrix re-runs strands on every PR push and surfaces the inherited breakage. Fix: delete the malformed lockfile and regenerate with `npm install --legacy-peer-deps --package-lock-only` against the existing package.json. The new file is valid JSON (verified with `node -e "JSON.parse(...)"`) and `npm ci` succeeds locally with it. Lockfile size dropped from 849577 to 491930 bytes — the prior sync had bloated entries on top of being malformed. Also reverts the Dockerfile probe and the split-COPY workaround added in earlier commits on this branch (e82a938, b56a925, e7dcd3c). The probe was the right diagnostic — it printed the first 200 bytes of /app/package-lock.json and showed only "lockfileVersion: 3," before parse error, which pointed at the malformed JSON. With a valid lockfile, `COPY ... && npm ci` works on the simple Dockerfile shape and the workaround is no longer needed. 2. setup-concept.test.ts path-traversal test had a /tmp race. The fix landed in e82a938 wrote a decoy file via `path.dirname(tmp)` — which resolves to the system temp root (`/tmp` on Linux, `/var/folders/.../T` on macOS), not a per-test scratch dir. Two concurrent runs of the test (e.g. `vitest --watch` re-firing mid-edit, or a developer running tests in two terminals) would race on the same shared decoy path; the second's finally-cleanup could delete the first's decoy mid-test and mask a real path-traversal regression. Fix: mkdtemp a per-test `scratch` directory in beforeEach, nest `tmp` inside it, plant the decoy in `scratch`, and let afterEach's recursive rmSync of `scratch` handle cleanup. Removes the try/finally block entirely. Comment math also corrected (the test walks four `..` segments, not three). Call-site enumeration: - Dockerfile: only the `Showcase: Build & Push` and `Build Check (PR)` workflows invoke this. Same `COPY ... && npm ci` shape as every other integration Dockerfile. - package-lock.json: consumed by `npm ci` only. New file generated by npm itself from the same package.json the previous lockfile targeted. - setup-concept.test.ts: no external consumers; helper variables `scratch`/`tmp` are module-local. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Breadcrumbs

User selector

Commit history

Commits on Jun 2, 2026

Commits on May 29, 2026

Commits on May 27, 2026

Commits on May 20, 2026