fix: npm 10+ compatibility across the update and install surfaces

[ayushnangia]

Fixes #738. Fixes #749. Fixes #741.

Problem

Three faces of one drift: npm's CLI moved (10, 11) and prime-agent's own update-command migration left the TUI behind.

1. /update --extensions always fails (/update --extensions always fails with "Update exited with code 1"; update-available notice is a false positive on npm >= 11 #738): the standalone update command deliberately hard-rejects package targets ("Package updates moved to the package command", public-command.ts:129) — but the TUI still spawns update --extensions for the flow it advertises in the slash hint and the startup notice. Every advertised path exits 1.
2. Update notice is a permanent false positive on npm ≥ 11 (/update --extensions always fails with "Update exited with code 1"; update-available notice is a false positive on npm >= 11 #738): npm view <pkg> version --json now emits a JSON array; getLatestNpmVersion parsed it verbatim, and ["2.87.2"] !== "2.87.2" is always true — so every startup nags, funneling users into defect 1.
3. PATH recovery instructions use a removed command (Installer gives unsupported npm bin -g PATH instructions on npm 10+ #749): install.sh tells users to run npm bin -g, which npm 10 removed.

Change

• interactive-mode.ts: non-self updates now spawn package update with legacy flags translated (translatePackageUpdateArgs: --extensions → bare, --extension <src> → positional, daemon-socket plumbing dropped). Self-updates unchanged. The advertised /update --extensions flow now runs the command the CLI migration intended.
• package-manager.ts: normalizeNpmViewVersion handles the npm 10 bare-string and npm ≥ 11 array forms, takes the newest entry, and fails loudly on malformed output.
• install.sh: PATH guidance prints echo "$(npm prefix -g)/bin" instead of npm bin -g.

Tests

test/suite/regressions/738-npm-update-compat.test.ts (9 tests, fail on main — the helpers don't exist): all translation shapes, agreement with updateArgsIncludeSelf about what routes to the package path, both npm output forms, newest-entry selection, loud rejection of empty/malformed output, and the exact false-positive equality from the report.

Neighbor suites (interactive-mode-effort-command, public-command): 47/47. npm run check clean, including the installer render gate.

Scope notes

• install fails on npm 12+ due to allow-remote=none #741 is now included (00d8d19): @d4not verified the mechanism on npm 12.0.2 — EALLOWREMOTE from transitive URL dependencies (R2-hosted runtime tarballs), root insufficient. The installer scopes npm_config_allow_remote=all to its own npm install -g invocations via env (no ~/.npmrc changes), gated to npm ≥ 12 so older versions see no unknown-config warnings. Scope notes: the npm self-update step (config.ts makeSelfUpdateCommandStep) has the same exposure on npm 12; and the deeper fix — publishing without URL transitive deps — is a release-pipeline call, so both are left for maintainers rather than decided here.
• The slash argumentHint and startup-notice wording still advertise --extensions; they now work as advertised, so the wording is untouched.

Note

Fix npm 10+ compatibility in package install and update flows

• Replaces deprecated npm bin -g with npm prefix -g in install.sh and adds npm_config_allow_remote=all env prefix for npm >= 12 to avoid EALLOWREMOTE errors from transitive URL dependencies.
• Adds normalizeNpmViewVersion in package-manager.ts to handle the changed output format of npm view <pkg> version --json between npm 10 (string) and npm 11+ (array).
• Rewrites the TUI non-self update path in interactive-mode.ts to translate legacy /update flags into the package update subcommand syntax, fixing package updates that broke with newer npm CLI argument handling.
• Adds regression tests in 738-npm-update-compat.test.ts covering flag translation, version normalization, and error handling.

^{Macroscope summarized 00d8d19.}

[ayushnangia]

Noting this for whichever maintainer picks the npm-compat area: given the clean-room approach you used on #717 → #1153 and #731 → #1164, I assume these remaining fix PRs of mine (this one, #721, #722, #723, #724, #730) are also best treated as bug reports rather than import candidates — which is completely fine. Each contains a full diagnosis, a minimal repro, and regression tests that stand alone: the npm-12 EALLOWREMOTE semantics in this one were independently verified by @d4not (comment history). Happy to leave them open as living reports, or convert each into a proper issue if that fits your triage flow better — just say which you'd prefer. The root causes matter more than the diffs.

[kevinjosethomas]

Hi, thanks for taking the time to contribute to Prime Agent! Since open sourcing the project, we’ve received far more pull requests than we can responsibly review and validate. Prime Agent runs directly on users’ machines, so we need to be deliberate about which changes we accept and how they are reviewed. Rather than leave a large backlog that we cannot meaningfully work through, we’re closing the current PR queue and moving to a discussion-first contribution process.

We have established new contribution guidelines to help us continue iterating on Prime Agent and better manage contributions from the community. Going forward, we won’t review unsolicited pull requests. Instead, please start with a GitHub Discussion. We’ll identify recurring bugs and feature requests, create Issues for work we want to pursue, and invite pull requests from maintainers or vouched contributors when implementation is ready. Please read the full process documented in our contribution guidelines.

While we’re closing this backlog, we’re still reviewing it at a high level to identify recurring bugs, useful ideas, and important problems that we should address ourselves. Thanks again for the time you put into this!

[ayushnangia]

Makes sense — a local agent that runs on users' machines needs the tighter intake, and discussions-first is the right shape for it. The six reports this account left behind (#721, #722, #723, #724, #730, #773) each contain a full diagnosis and standalone repro/regression tests; if any of them correspond to work you'd want pursued, happy to file them as Discussions with the diagnostics carried over — or just let them stand as reference material while you triage the backlog. Thanks for the deliberate process.