bug: shell install command fails on `npm` >=12

[madkarmaa]

What happen

Ran the shell install command and it failed:

npm error code EALLOWGIT
npm error Fetching packages of type "git" have been disabled
npm error Refusing to fetch "github:JuliusBrussee/caveman"
npm error A complete log of this run can be found in: /home/user/.npm/_logs/2026-07-11T14_01_09_335Z-debug-0.log

Reason

> npm -v
12.0.0

• allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies.

Source

Fix

macOS · Linux · WSL · Git Bash

export NPM_CONFIG_ALLOW_GIT=all
curl -fsSL https://raw.githubusercontent.com/JuliusBrussee/caveman/main/install.sh | bash
unset NPM_CONFIG_ALLOW_GIT

Windows · PowerShell 5.1+

$env:NPM_CONFIG_ALLOW_GIT = "all"
irm https://raw.githubusercontent.com/JuliusBrussee/caveman/main/install.ps1 | iex
Remove-Item Env:NPM_CONFIG_ALLOW_GIT

Platform

• Claude Code
• Codex
• Other: global (~/.agents)

Version / install method
Latest / shell install command

[AmirF194]

Reproduced on main @ 0d95a81d, node:22-slim + npm@12.0.1 + git installed:

$ npx -y github:JuliusBrussee/caveman --help
npm error code EALLOWGIT
npm error Fetching packages of type "git" have been disabled
npm error Refusing to fetch "github:JuliusBrussee/caveman"

Root cause matches what's already in the report: install.sh:54 (exec npx -y "github:$REPO" "$@") and the mirrored install.ps1:72 call npx on a github: spec with no NPM_CONFIG_ALLOW_GIT/--allow-git set, and npm 12 defaults allow-git/allow-remote to none. Confirmed the reporter's workaround clears it: same container, export NPM_CONFIG_ALLOW_GIT=all before the npx call runs the installer to completion (exit 0).

Since this only bites the curl-pipe path (bash install.sh / local clone with bin/install.js skip npx entirely per lines 41-44), the fix can be scoped to the two exec npx lines: set NPM_CONFIG_ALLOW_GIT=all as an env prefix on those calls specifically, rather than exporting it into the user's shell.

Been open 18 days with no maintainer reply; flagging since it blocks the documented one-line install on any npm >=12 host.

[madkarmaa]

fixed with commit ed1fbb7 and v1.10.0