fix(installer): use npm cli for Pro artifact install under npx

[rafaelscosta]

Summary

• Fix Pro artifact extraction when the installer is launched through npx -p @aiox-squads/core aiox install
• Derive sibling npm-cli.js when npm_execpath points to npx-cli.js
• Bump @aiox-squads/core to 5.2.9 and @aiox-squads/installer to 3.3.8

Root Cause

In Linux/npm flows, npm_execpath can point at npx-cli.js. The installer trusted that value as npm and effectively ran node npx-cli.js install <pro-artifact.tgz> --prefix <target>, which dispatches to an install package/binary and fails with unexpected argument --prefix found.

Verification

• npx jest tests/installer/pro-setup-auth.test.js tests/installer/pro-setup-target-install.test.js --runInBand --forceExit
• npm run validate:publish
• npm run lint
• npm run test:ci
• git diff --check

User Check

jpvalente72@gmail.com is not blocked by seats: license has 2/3 active seats and 1 available.

Summary by CodeRabbit

• Bug Fixes

  • Fix Pro artifact installation when invoked via npx by ensuring the installer uses the appropriate npm executable for reliable extraction.

• Chores

  • Version bump to 5.2.9 across packages.
  • Installer dependency updated to 3.3.8.
  • Manifest metadata refreshed.

• Tests

  • Added tests covering npm executable resolution behavior.

• Documentation

  • Added CHANGELOG entry for 5.2.9 (2026-05-21).

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
aiox-core	Ready	Preview, Comment	May 21, 2026 1:46am

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 9685aa0b-98fe-4fd3-8463-4b554c7ffb14

📥 Commits

Reviewing files that changed from the base of the PR and between 441b090 and fd40047.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (8)

• .aiox-core/install-manifest.yaml
• .aiox-core/package.json
• CHANGELOG.md
• compat/aiox-core/package.json
• package.json
• packages/installer/package.json
• packages/installer/src/wizard/pro-setup.js
• tests/installer/pro-setup-auth.test.js

✅ Files skipped from review due to trivial changes (5)

• .aiox-core/package.json
• .aiox-core/install-manifest.yaml
• packages/installer/package.json
• CHANGELOG.md
• tests/installer/pro-setup-auth.test.js

---

Walkthrough

Version 5.2.9 release that fixes Pro artifact installation when invoked via npx by resolving the npm executable path from npm_execpath (mapping npx-cli.js to npm-cli.js when available), with synchronized version and manifest bumps and added tests.

Changes

Npm path resolution fix and test coverage

Layer / File(s)	Summary
Npm path resolution logic packages/installer/src/wizard/pro-setup.js, tests/installer/pro-setup-auth.test.js	Added resolveNpmExecPath to interpret npm_execpath, mapping npx-cli.js to adjacent npm-cli.js (with Windows path handling); updated resolveNpmInvocation to use the resolved cli path via prefixArgs when present. Added two tests verifying mapping and fallback to npm.

Version and manifest synchronization

Layer / File(s)	Summary
Package version updates across monorepo package.json, .aiox-core/package.json, compat/aiox-core/package.json, packages/installer/package.json	Bumped package versions to 5.2.9 (root, .aiox-core, compat wrapper) and packages/installer to 3.3.8; updated compat wrapper dependency on @aiox-squads/core to 5.2.9.
Manifest and changelog updates .aiox-core/install-manifest.yaml, CHANGELOG.md	Updated install manifest version and generated_at, changed recorded sha256 for monitor/hooks/user_prompt_submit.py, and added a 5.2.9 changelog entry documenting the npx/npm invocation behavior and installer bump.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• SynkraAI/aiox-core#735: Updates npm invocation logic in packages/installer/src/wizard/pro-setup.js and adds test coverage for resolveNpmInvocation resolution strategy.

Suggested reviewers

• oalanicolas
• Pedrovaleriolopez

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: fixing npm CLI resolution for Pro artifact installation when invoked via npx, which is the core objective of this changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/pro-artifact-npx-npm-invocation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

📊 Coverage Report

Coverage report not available

📈 Full coverage report available in Codecov

---

Generated by PR Automation (Story 6.1)