From ee6ff221a056ef7f4e20979b9e9455a79032c984 Mon Sep 17 00:00:00 2001 From: Cathie Integra Date: Mon, 13 Apr 2026 15:11:51 +0200 Subject: [PATCH] Docs: Note "--ignore-scripts" for npm outside the dev image Co-Authored-By: Claude Opus 4.6 (1M context) --- .claude/CLAUDE.md | 2 +- AGENTS.md | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md index ba329feb9..fadd2caaa 100644 --- a/.claude/CLAUDE.md +++ b/.claude/CLAUDE.md @@ -17,7 +17,7 @@ Run `make help` to list all available targets. Key commands: **Dependencies:** - `make dep` — install all dependencies (TensorFlow models, ONNX models, JS packages) -- `make dep-js` — install JS dependencies only (`npm ci`) +- `make dep-js` — install JS dependencies only (`npm ci`). The `photoprism/develop` base image sets the npm env to ignore install scripts; when running `npm ci` or `npm install` outside that image (e.g. in a coding-agent env that doesn't inherit it), pass `--ignore-scripts` explicitly to mitigate supply-chain attacks. **Docker dev environment:** - `make docker-build` — build local Docker image diff --git a/AGENTS.md b/AGENTS.md index f2be6f1be..e28b43b1d 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -112,6 +112,7 @@ Title Case rules: - Bash check: `[ -f "/.dockerenv" ] && echo container || echo host` - Node.js check: `require("fs").existsSync("/.dockerenv")` - Inside the container, prefer `npm exec --yes -- --help` or `npx ...`; if a global npm install is unavoidable, install it only inside the container. +- The `photoprism/develop` base image sets the npm env to ignore install scripts by default. When running `npm ci` or `npm install` outside that image — e.g. in a coding-agent env that does not inherit it — pass `--ignore-scripts` explicitly to mitigate supply-chain attacks; add a targeted `npm rebuild ` only if a native addon needs compiling. - On the host, use the vendor-recommended install method and run from the repository root so agent discovery sees this file. ## Build, Format & Test