chore: update package.json for canary test

[pullfrog]

Updates package.json as part of the dependency installation canary test — replaces the original repo metadata with the test fixture used to probe postinstall script execution behavior.

  ^{｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

---

Note

Medium Risk
Adds a postinstall script that writes to /tmp, which will execute during dependency installation and could affect CI/build environments. Scope is limited to package.json but changes install-time behavior.

Overview
Switches package.json from a minimal private test project to a published-style package (name/version) and removes the vitest test script.

Adds a postinstall hook that writes CANARY_MARKER to /tmp/postinstall-canary.txt to probe install-time script execution, and sets an explicit empty dependencies object.

^{Reviewed by Cursor Bugbot for commit bd93265. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Removal of private flag risks accidental npm publish

Medium Severity

The original package.json had "private": true which prevents accidental publishing to npm. The replacement drops this field entirely while also giving the package a publishable name (test-pkg) and version (1.0.0). Running npm publish — even accidentally — would now succeed rather than being blocked.

 

^{Reviewed by Cursor Bugbot for commit a71fb22. Configure here.}

[cursor]

Test script removed, breaking existing test execution

Medium Severity

The "test": "vitest run" script was replaced entirely by the postinstall script. The repo still contains test/math.test.ts which imports from vitest, so npm test will now fail with a missing script error. The canary postinstall entry could coexist alongside the original test script instead of replacing it.

 

^{Reviewed by Cursor Bugbot for commit a71fb22. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 3 total unresolved issues (including 2 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e22785c. Configure here.}

[cursor]

Test fixture overwrites project config, breaking existing tests

Medium Severity

The "test": "vitest run" script and "type": "module" declaration were removed and replaced with only a postinstall canary script. The repo still contains vitest tests (test/math.test.ts) and ESM source files (src/*.ts using export), so npm test is now broken and module resolution for the existing code may fail. This looks like a test fixture that's replacing the real project configuration.

 

^{Reviewed by Cursor Bugbot for commit e22785c. Configure here.}