3f867b2ca9
npm reads the project's own .npmrc, $HOME, and the global config. It does not walk up parent directories (npm/npm#11437 is still open), so the root .npmrc gates the root install and nothing else. Two nested projects were resolving with no supply-chain quarantine at all: scripts/whatsapp-bridge and plugins/platforms/photon/sidecar. Both now carry their own gate, and `npm ci` in each returns its lockfile byte-identical. A project is a directory holding both package-lock.json and package.json -- the pair npm resolves against. A lockfile with no manifest beside it is a vendored artifact; nix/ keeps one for a hash-pinned fetch that never consults npm config. The required floor is read from the root .npmrc instead of hardcoded, so the standard is raised in one place. A nested project may be stricter, never weaker. |
||
|---|---|---|
| .. | ||
| browser | ||
| context_engine | ||
| cron_providers | ||
| dashboard_auth | ||
| disk-cleanup | ||
| google_meet | ||
| hermes-achievements | ||
| image_gen | ||
| kanban | ||
| memory | ||
| model-providers | ||
| observability | ||
| platforms | ||
| security-guidance | ||
| spotify | ||
| teams_pipeline | ||
| video_gen | ||
| web | ||
| __init__.py | ||
| plugin_utils.py | ||