[user-github-me]

What

Keep similarly named packages out of Hyperframes project-pin detection and upgrades. npx @acme/hyperframes@1.2.3 preview and npx custom-hyperframes@1.2.3 preview retain version 1.2.3 when upgrade --project bumps the project's real hyperframes pin.

Why

On main 46f6cb356785bed79e1ce7b79d7e7accc697786a, the word-boundary matcher also starts after a scope slash, hyphen, or dot. It therefore rewrites unrelated package versions in package.json scripts and project-root shell wrappers, and reports those versions as Hyperframes pins.

Related work

#2304 introduced project-pin upgrades; #3042 extended them to root shell wrappers; #4417 uses the same reader for stale-pin notices. Checked the files of all 152 current open PRs and searched open/closed project-pin work; no overlapping implementation found.

How

Exclude package-name and scope characters immediately before hyperframes. Keep the existing version validation and right boundary, with the version still in capture group 1. Standalone pins and --package=hyperframes@<version> keep working.

Test plan

• Five new regression cases fail on main; all 64 project-pin, upgrade and update-notice tests pass after the fix. Coverage includes scoped/hyphenated/dotted names, mixed scripts and wrappers, and unrelated-only projects in check and apply modes.
• Built CLI manual check in disposable project directories: upgrade --project --json --check writes nothing; apply updates only genuine pins; an unrelated-only project's package.json and wrapper stay byte-identical. A synthetic registry response fixes the target version without installing packages or touching user configuration.
• CLI build/typecheck, root lint, changed-file formatting, whitespace, test reachability, comment checks and normal commit hooks pass.
• Documentation: no command or option changes.

[jrusso1020]

Verified the bug on main: HYPERFRAMES_PIN_RE starts with \b, which matches after the / in @acme/hyperframes@1.2.3 and after the - in custom-hyperframes@1.2.3, so upgrade --project rewrites those versions and readPinnedHyperframesVersions reports them as pins. The new negative lookbehind rejects package-name and scope characters but still allows whitespace, quotes and =, so standalone pins and --package=hyperframes@<v> keep matching, and the regex is used only inside projectPin.ts. The tests cover scoped, hyphenated and dotted names in both package.json scripts and shell wrappers, in check and apply modes. Need: yes, still broken on main · Size: ok · Reuse: n/a · Simpler: already minimal.

— Rames