From 7f0742c77266da3e3587643a4b3bdebb31b774c5 Mon Sep 17 00:00:00 2001
From: Furkan <esquetta@gmail.com>
Date: Tue, 21 Jul 2026 10:45:52 +0300
Subject: [PATCH] fix: support npm 12 in release checks

---
 scripts/release-check.mjs   | 20 +++++++++++++++++++-
 tests/release-check.test.ts | 15 ++++++++++++++-
 2 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/scripts/release-check.mjs b/scripts/release-check.mjs
index 62d416a..95175e7 100644
--- a/scripts/release-check.mjs
+++ b/scripts/release-check.mjs
@@ -113,7 +113,7 @@ export function assertFreshInstallAudit(version, options = {}) {
       ["pack", "--json", "--pack-destination", tempDirectory],
       { capture: true }
     );
-    const [{ filename }] = JSON.parse(packOutput);
+    const filename = parsePackedTarballFilename(packOutput);
     const tarballPath = path.join(tempDirectory, filename);
 
     commandRunner("npm", ["init", "-y"], { cwd: tempDirectory });
@@ -141,6 +141,24 @@ export function assertFreshInstallAudit(version, options = {}) {
   }
 }
 
+export function parsePackedTarballFilename(packOutput) {
+  const parsed = JSON.parse(packOutput);
+  const entries = Array.isArray(parsed)
+    ? parsed
+    : parsed && typeof parsed === "object"
+      ? Object.values(parsed)
+      : [];
+  const metadata = entries.find(
+    (entry) => entry && typeof entry === "object" && typeof entry.filename === "string"
+  );
+
+  if (!metadata) {
+    throw new Error("npm pack did not return tarball metadata.");
+  }
+
+  return metadata.filename;
+}
+
 export function assertUpdateCheckSmoke(version, options = {}) {
   const commandRunner = options.run ?? run;
   const output = commandRunner(
diff --git a/tests/release-check.test.ts b/tests/release-check.test.ts
index 07288ce..61fb340 100644
--- a/tests/release-check.test.ts
+++ b/tests/release-check.test.ts
@@ -6,7 +6,8 @@ import {
   assertFreshInstallAudit,
   assertSecuritySelfScan,
   assertUpdateCheckSmoke,
-  assertVersionIsPublishable
+  assertVersionIsPublishable,
+  parsePackedTarballFilename
 } from "../scripts/release-check.mjs";
 
 describe("release check registry version gate", () => {
@@ -50,6 +51,18 @@ describe("release check registry version gate", () => {
 });
 
 describe("release check fresh install audit gate", () => {
+  it("reads npm pack metadata from npm 10 through npm 12", () => {
+    const metadata = { filename: "codex-plugin-doctor-1.50.0.tgz" };
+
+    expect(parsePackedTarballFilename(JSON.stringify([metadata]))).toBe(metadata.filename);
+    expect(
+      parsePackedTarballFilename(JSON.stringify({ "codex-plugin-doctor": metadata }))
+    ).toBe(metadata.filename);
+    expect(() => parsePackedTarballFilename("null")).toThrow(
+      "npm pack did not return tarball metadata."
+    );
+  });
+
   it("installs the packed tarball in a fresh project and audits it", () => {
     const tempDirectory = path.join("tmp", "release-check-temp");
     const run = vi.fn((command: string, args: string[]) => {