Fix global npm installs for 0.3.7

[Advait Paliwal (advaitpaliwal)]

Summary

• bundle Feynman's exact direct @opentelemetry/api dependency so npm global installs cannot leave its hoist target empty
• exercise the exact candidate tarball through clean global-install version/help checks on every Linux/macOS/Windows Node 22/24/25 consumer
• verify the published registry package through the same global-install path before release completion
• release as 0.3.7

Root cause

Published 0.3.6 starts correctly from a normal project-prefix install because npm can hoist @opentelemetry/api@1.9.1. Under both an existing ~/.npm-global prefix and a fresh global prefix, npm instead created an empty node_modules/@opentelemetry/api beside the bundled Pi packages. Feynman then failed during the direct telemetry import before command dispatch.

Verification

• focused release/release-note tests: 10/10
• full tests: 653/653
• typecheck, build, architecture check, actionlint
• website lint/typecheck/build: 34 pages
• root and website full/production audits: 0 vulnerabilities
• dry and real pack matched: 111,637,876 bytes, 39,692 files, SHA-256 941389ca83a06b49105a4c07515fad1e250617ced593192ad2a90c4b851b61a0
• clean consumer and extracted runtime audits: 0 vulnerabilities
• installed artifact verifier: Pi 0.82.1, runtime SHA-256 c31b7db649f47997abfc6a3622c5af1758af71789a5eae9c96c98932c3d96ac1
• clean global installs under npm 11.16.0 and 11.18.0: version/help passed with nonempty bundled OpenTelemetry API 1.9.1 trees
• installed RPC: 112 commands, including thinking and web-results

Exact pushed-SHA Daytona and GitHub cross-platform gates remain required before merge.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
feynman	Ready	Preview, Comment	Jul 28, 2026 10:51pm

[Advait Paliwal (advaitpaliwal)]

Clean-machine receipt: disposable Daytona sandbox e57f099a-36c6-43d5-b3e7-6f0fc5ddaf02 checked out exact head f1903a1b662de0d3ea846b04b38bd0290933ddd5 on Linux with Node 25.9.0 / npm 11.12.1. Full tests passed (653/653); typecheck, build, architecture check, website lint/typecheck/build (34 pages), root/site full and production audits, and git diff --check passed. The packed tarball was 112224596 bytes at SHA-256 d3e0b3bc01c5382b500d6079d9a40854bd08422c1fc5a732eab2f172e55ce4b7; clean consumer/runtime audits and artifact verification passed with runtime SHA-256 279620707dd9401e009ca6b78bb53e9357f8bfe5813be16744234db23e0444c3. A clean global install passed version/help with bundled OpenTelemetry API 1.9.1 present and nonempty. The sandbox was deleted and confirmed absent.