From 7b6a29ca114f92333ebac01a16c7ef198b9d90bb Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Sat, 25 Jul 2026 21:19:28 -0700
Subject: [PATCH] fix(release): support npm 12 in ClawHub materializer
 (#114008)

---
 scripts/materialize-clawhub-cli.sh               | 16 ++++++++++------
 test/scripts/plugin-clawhub-new-workflow.test.ts |  2 ++
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/scripts/materialize-clawhub-cli.sh b/scripts/materialize-clawhub-cli.sh
index 5c51dcdcf563..5c8ac1fb5783 100755
--- a/scripts/materialize-clawhub-cli.sh
+++ b/scripts/materialize-clawhub-cli.sh
@@ -38,12 +38,16 @@ clawhub_integrity="$(
   exit 1
 }
 
-npm ci \
-  --prefix "${destination}" \
-  --ignore-scripts \
-  --no-audit \
-  --no-fund \
-  --omit=dev
+# npm 12 misvalidates the lockfile root when this project is selected with --prefix.
+# Running inside the copied project keeps its committed root metadata authoritative.
+(
+  cd "${destination}"
+  npm ci \
+    --ignore-scripts \
+    --no-audit \
+    --no-fund \
+    --omit=dev
+)
 
 clawhub_version="$(
   CLAWHUB_CLI_ROOT="${destination}" \
diff --git a/test/scripts/plugin-clawhub-new-workflow.test.ts b/test/scripts/plugin-clawhub-new-workflow.test.ts
index 8a2e53ca4ef3..8bb61bfe51ca 100644
--- a/test/scripts/plugin-clawhub-new-workflow.test.ts
+++ b/test/scripts/plugin-clawhub-new-workflow.test.ts
@@ -334,6 +334,8 @@ describe("Plugin ClawHub New workflow", () => {
       version: "0.23.1",
     });
     expect(materializerSource).toContain("npm ci");
+    expect(materializerSource).toContain('cd "${destination}"');
+    expect(materializerSource).not.toContain('--prefix "${destination}"');
     expect(materializerSource).toContain("--ignore-scripts");
     expect(materializerSource).toContain("--omit=dev");
     expect(materializerSource).toContain(