feat(caching): fix CAS pollution and enforce local extraction for -P installations

Author: oxanmerym

.gitignore

@@ -87,4 +87,5 @@ simulation/
 /xfpm
 dist/
 tmp/
-pl.sh
+pl.sh
+current-notes.md

internal/core/installer.go

@@ -294,11 +294,12 @@ func (i *Installer) ensureExtracted(ctx context.Context, pkg *ResolvedPackage, t
 	pkgVStoreName := strings.ReplaceAll(pkg.Name, "/", "+") + "@" + pkg.Version
 	pkgDir := filepath.Join(targetVStore, pkgVStoreName, "node_modules", pkg.Name)
 
+	if pkg.LocalPath != "" { return i.extractLocal(pkg, targetVStore) }
+
 	if !i.Force {
 		if _, err := os.Stat(filepath.Join(pkgDir, "package.json")); err == nil { return nil }
 	}
 
-	if pkg.LocalPath != "" { return i.extractLocal(pkg, targetVStore) }
 
 	// [OPTIM] Check Global CAS first before network download
 	if !i.Force && i.cas.HasIndex(pkg.Name, pkg.Version) {
@@ -807,7 +808,7 @@ func (i *Installer) extractLocal(pkg *ResolvedPackage, targetVStore string) erro
 		fileMap["package/"+relPath] = hash
 		return nil
 	})
-	i.cas.StoreIndex(pkg.Name, pkg.Version, fileMap)
+	// i.cas.StoreIndex(pkg.Name, pkg.Version, fileMap) // DO NOT cache index for local installs to prevent poisoning NPM cache
 	i.LinkFilesToDir(pkgDir, fileMap)
 	i.changedPackages.Store(pkg.Name+"@"+pkg.Version, true)
 
@@ -1047,7 +1048,7 @@ func (i *Installer) VerifySignatureInternal(sigPath string, pkg *ResolvedPackage
 			pluginCfg["permissions"] = permCfg
 		}
 
-		internal[pkg.Name] = pluginCfg
+		internal[pkg.Name] = pluginCfg 
 		config["$internal"] = internal
 
 		if out, err := json.MarshalIndent(config, "", "    "); err == nil {

internal/utils/lib_version.go

@@ -1,3 +1,3 @@
 package utils
 
-const BinVersion = "vG0.1.221"
+const BinVersion = "vG0.1.222"

release-note.md

@@ -1,3 +1,9 @@
+## [G0.1.222] - 2026-06-09
+
+### Caching & Local Installation Fix
+- **CAS Pollution Prevention**: Fixed a critical caching issue where installing packages via local path (`xfpm install -P`) would incorrectly cache the source files in the global Content Addressable Storage (CAS) index. This previously caused subsequent normal `npm` installations of the same version to fetch stale local files instead of downloading the fresh registry tarball.
+- **Forced Local Extraction**: Modified `ensureExtracted` to completely bypass the `package.json` cache check when `-P` is supplied. Local paths will now forcefully extract and link their current source files every time, guaranteeing the latest code is reflected without manual cache clearing.
+
 ## [G0.1.221] - 2026-06-08
 
 ### Engine Upgrades

version.json

@@ -2,10 +2,10 @@
   "name": "XFPM (XyPriss Package Manager)",
   "description": "The ultra-fast package manager for the XyPriss ecosystem.",
   "warning": "CRITICAL: Public modifications to this file are strictly forbidden. Internal Nehonix metadata ONLY.",
-  "latest": "vG0.1.221",
-  "message": "Features: Integrated XRU v0.2.8 with full `--name` argument support and hardened `#IF` evaluation logic.",
+  "latest": "vG0.1.222",
+  "message": "Features: Fixed global CAS cache pollution during local `-P` installations by forcing local package extractions.",
   "metadata": {
-    "releaseDate": "2026-06-08",
+    "releaseDate": "2026-06-09",
     "channel": "stable"
   }
 }