npm audit fix / fresh install crashes: arborist null-deref in vitest peer-set resolution

Summary

While preparing a release pass (bumping/reviewing PRs, running `npm audit`), found that `npm audit fix`, `npm update`, and a fresh `npm install` with no existing `package-lock.json` all crash inside `agentic-flow/` with the same internal npm error. Installing normally with the existing lockfile present works fine — this only affects operations that force npm to rebuild the ideal dependency tree from scratch.

Repro

cd agentic-flow
rm -rf node_modules package-lock.json
npm install

npm error Cannot read properties of null (reading 'edgesOut')

Stack trace bottoms out in npm's own arborist internals, recursing through `#loadPeerSet` while resolving `vitest`'s peer-dependency set (specifically while fetching manifests for `@vitest/browser-playwright`, `@vitejs/devtools*`, then `vitest@4.1.11` / `@vitest/coverage-v8@4.1.11`):

TypeError: Cannot read properties of null (reading 'edgesOut')
    at #loadPeerSet (.../npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js:1289:38)
    at async #loadPeerSet (...:1297:11)   [recurses 3x]
    at async #buildDepStep (...:904:11)
    at async Arborist.buildIdealTree (...:181:7)

Environment: npm 10.9.8, Node 22.22.1, macOS.

Impact

• `npm audit fix` and `npm update` are both unusable in this package today — blocking the normal, safe remediation path for the ~20 dependency vulnerabilities `npm audit` currently reports as `fixAvailable: true` (mostly transitive: hono, fast-uri, ws, axios, minimatch, postcss, rollup, vite, undici, etc. — see `npm audit` output for the full list).
• A contributor doing a from-scratch clone + `npm install` with no lockfile will also hit this.
• Existing lockfile-based installs (`npm ci`, or `npm install` with the current `package-lock.json` present) are not affected — this only reproduces when arborist has to build the ideal tree from scratch.

Likely cause (not fully diagnosed)

This looks like a known class of npm/arborist bug where a complex/self-referential peer-dependency graph (vitest 4.x's peer set includes several `@vitejs/devtools-*` packages plus `@vitest/browser-playwright`, forming a dense peer graph) trips a null-dereference in npm's own tree-building code — not something wrong with this repo's dependency declarations per se, but the current `vitest@^4.0.14` range resolves into a peer-dependency shape that npm 10.9.8's arborist can't walk without crashing.

Suggested next steps

• Try reproducing on a newer/older npm (11.x, or 10.8.x) to bisect whether this is npm-version-specific.
• If it reproduces broadly, consider pinning `vitest`/`@vitest/coverage-v8` to a version just outside the affected peer-graph shape, or filing upstream against npm/cli with this exact repro.
• Once resolved, re-run `npm audit fix` to pick up the ~20 pending non-breaking dependency bumps.

🤖 Generated with RuFlo

Start in agentic-flow by removing node_modules and package-lock.json, then run npm install to confirm the arborist null-dereference while resolving the vitest peer set. Compare the result on npm 10.8.x and 11.x, and use the existing lockfile and npm audit output as references. Done means fresh installation, npm update, and npm audit fix no longer crash, with the pending dependency remediation addressed or an upstream npm issue clearly identified.