v0.8.66: Honor codewhaleBinaryVersion in npm installer

[Hmbown]

Why this matters

The npm wrapper has a dedicated codewhaleBinaryVersion field so packaging-only npm releases can point at the intended CodeWhale binary version. run.js and verify-release-assets.js already honor that field, but the installer path skips it. That means install-time asset resolution can disagree with runtime/version-fallback and release-asset verification.

Current behavior

npm/codewhale/scripts/install.js resolves the package binary version from legacy env vars and deepseekBinaryVersion, then falls back to pkg.version:

• npm/codewhale/scripts/install.js:81-87

const configuredVersion =
  process.env.DEEPSEEK_TUI_VERSION ||
  process.env.DEEPSEEK_VERSION ||
  pkg.deepseekBinaryVersion ||
  pkg.version;

The sibling npm wrapper surfaces already include pkg.codewhaleBinaryVersion:

• npm/codewhale/scripts/run.js:12
• npm/codewhale/scripts/verify-release-assets.js:14-18
• npm/codewhale/scripts/verify-release-assets.js:49-50

Desired behavior

1. install.js should resolve pkg.codewhaleBinaryVersion before pkg.deepseekBinaryVersion and pkg.version.
2. run.js, install.js, and verify-release-assets.js should agree on binary-version precedence.
3. Packaging-only npm releases should be able to change wrapper version and binary version intentionally without install-time asset drift.

Repro or evidence

Inspect the current version-resolution code:

nl -ba npm/codewhale/scripts/install.js | sed -n '81,87p'
nl -ba npm/codewhale/scripts/run.js | rg -n "codewhaleBinaryVersion|deepseekBinaryVersion" -C 2
nl -ba npm/codewhale/scripts/verify-release-assets.js | rg -n "codewhaleBinaryVersion|deepseekBinaryVersion" -C 2

install.js is the only npm wrapper path that skips pkg.codewhaleBinaryVersion.

Acceptance criteria

• install.js honors pkg.codewhaleBinaryVersion before legacy deepseekBinaryVersion and pkg.version.
• Add a focused npm installer test or script-level assertion covering codewhaleBinaryVersion precedence.
• Existing legacy env var behavior remains unchanged.
• run.js, install.js, and verify-release-assets.js use consistent binary-version precedence.
• Relevant npm wrapper tests/checks pass.

Related

• Related: release: harden Cargo and npm publish recovery checklist #2643, broader closed release/publish recovery hardening.