Why
The local-file npm regression tests depend on an unrelated online vulnerability audit. Both complete local package installation but can keep waiting for Arborist's audit promise, so the existing five-second deadlines fail before the package-reification and omit assertions are reached. The required Linux unit job failed twice at host commit 8d99729 with the same two timeouts; running the unchanged test file locally reproduced both. An isolated diagnostic observed the fixture entry installed while auditReport remained pending, and the same local install completed in 19 ms when audit was disabled only in the diagnostic options.
Scope
Only the temporary fixture .npmrc settings in packages/core/test/npm.test.ts for cache-directory reification and omit=dev. Preserve all assertions, the existing five-second timeout, real Arborist installation and the production npm audit defaults. No runtime implementation, workflow, policy or explicit security-audit gate changes.
Approach
Write audit=false into the existing local-file fixture projects before invoking the real Npm service. For the omit test retain omit=dev in the same file. This makes these filesystem/configuration regressions independent of the online advisory service without mocking the installer or weakening their behavioral assertions.
Acceptance
- Demonstrate the original tests failing on their unchanged five-second deadlines, then pass the same tests with all assertions retained.
- The cache fixture still proves an existing empty cache is reified into an installed package.
- The omit fixture still installs the production dependency and excludes the development dependency.
- Production npm configuration and explicit security checks are unchanged.
- Package typecheck, independent review, complete required CI and SpecGit acceptance pass before merge or release.
Why
The local-file npm regression tests depend on an unrelated online vulnerability audit. Both complete local package installation but can keep waiting for Arborist's audit promise, so the existing five-second deadlines fail before the package-reification and omit assertions are reached. The required Linux unit job failed twice at host commit 8d99729 with the same two timeouts; running the unchanged test file locally reproduced both. An isolated diagnostic observed the fixture entry installed while
auditReportremained pending, and the same local install completed in 19 ms when audit was disabled only in the diagnostic options.Scope
Only the temporary fixture
.npmrcsettings inpackages/core/test/npm.test.tsfor cache-directory reification andomit=dev. Preserve all assertions, the existing five-second timeout, real Arborist installation and the production npm audit defaults. No runtime implementation, workflow, policy or explicit security-audit gate changes.Approach
Write
audit=falseinto the existing local-file fixture projects before invoking the real Npm service. For the omit test retainomit=devin the same file. This makes these filesystem/configuration regressions independent of the online advisory service without mocking the installer or weakening their behavioral assertions.Acceptance