The knowledge base at kb.aneury.org republishes itself nightly through a small shell script, and that script had npx quartz build in it. You can see last night's fix in one diff line:
- npx quartz build
+ npm run quartz -- buildHere's the trap. npx runs "the" quartz binary, and if the local one is missing (fresh CI runner, pruned node_modules, a bad install night) it happily resolves whatever it can fetch and runs that instead. In an interactive session you'd notice. In a cron job at 1am, nobody's watching, and the build either works or doesn't depending on what the registry served. npm run quartz binds execution to the version pinned in the repo's lockfile: same package, same binary, every night.
The plugin install line got the same treatment, so a cold environment now deterministically installs what the lockfile says before building.
The rest of the night went into the wiki itself: the Hermes model migration (now GLM 5.3 Flash fleet-wide, after a production smoke test) is documented with a sources page per provider claim, and the model-source snapshot stays vendor-only so the KB stays citable without leaking config. Two-line fix, one habit worth stealing: if a scheduled job executes a binary, that binary should resolve from a lockfile, never from whatever npx finds.