fix(postinstall): do not install skills as another package's dependency

[ggordonhall]

Problem

scripts/postinstall.mjs auto-installs the packaged skills whenever npm_config_global is "true". npm sets that variable for the entire global install, including the lifecycle scripts of dependencies — so a package that merely depends on Context Tree triggers the auto-install.

The effect: npm i -g some-tool writes six skill directories into the user's own ~/.claude and ~/.codex as an invisible side effect of installing an unrelated tool. It is also why OpenTag could not take Context Tree as an ordinary dependency.

Fix

Also require that this package is the install target, not a nested copy. The distinction is structural:

npm i -g @first-tree-ai/context-tree
  -> <prefix>/lib/node_modules/@first-tree-ai/context-tree
     parent of node_modules is lib/ — not a package — install

npm i -g open-tag
  -> <prefix>/lib/node_modules/open-tag/node_modules/@first-tree-ai/context-tree
     parent of node_modules is open-tag/ — has a package.json — skip

Six lines in the script.

The e2e fixture had to change too, and that is worth a look

scripts/package-e2e.mjs simulated a global install by forcing npm_config_global=true on the locally installed copy under consumer/node_modules/. That is precisely the layout this change now refuses, so the fixture failed — correctly.

That shortcut was sound when the flag was the only signal, but it no longer models a global install. The e2e now installs for real into a temporary prefix (npm install -g --prefix), since the layout npm produces is the whole basis of the distinction. The nested case it used to stand in for is now asserted explicitly, in the direction we actually guarantee: hint printed, nothing written to the home directory.

Verification

npm run check, npm run typecheck, npm test (136 tests), and npm run check:package all pass.

Separately, against a packed tarball installed into an isolated prefix with HOME redirected:

Case	Result
Direct global install	installs 6 skills — unchanged
Global install of a dependent package	prints the hint, writes nothing
Same nested layout, guard removed	installs 6 skills — reproduces the bug
Local pnpm install	prints the hint — unchanged

The real ~/.claude and ~/.codex were fingerprinted before and after and are byte-identical.

The new unit test in tests/install.test.ts runs the script from both layouts rather than asserting on the guard's internals.

Note

This unblocks OpenTag taking @first-tree-ai/context-tree as a runtime dependency instead of vendoring it at build time (first-tree-ai/opentag#455).

🤖 Generated with Claude Code