reference dependencies

Dependencies

Active contributors: Mario Zechner, kt, Zachary BENSALEM

The repository uses one pnpm workspace and one root lockfile. Dependency policy is part of the build contract because the server consumes a stock runtime tarball and the browser bundle has enforced size boundaries.

Workspace toolchain

Area	Current choice	Source
Package manager	pnpm 11.15.1	Root package.json
Node floor	>=22.12.0	Root and packages/fleet-web/package.json
Web framework	Vite 8, TanStack Start/Router/Query, React 19	web/app/package.json
Styling	Tailwind CSS 4	web/app/package.json
Server bundling	esbuild 0.28.1, Node 22 target	scripts/build-web-release.mjs
Typechecking	tsgo --noEmit in workspace packages	Package scripts
Unit tests	Vitest 4.1 with happy-dom for the app	web/app/package.json, web/server/package.json
Browser smoke	Playwright 1.62	web/app/package.json
UI checks	OpenUI, component, registry, and rendering contracts	web/design/package.json

Package roles and key dependencies

• web/app (@prime-agent/web) depends on the web design, protocol, and server workspaces plus TanStack Start, React, Tailwind, and Zod. Its browser source must not import execution-runtime packages.
• web/design (@prime-agent/web-design) depends on Base UI, Motion, Lucide, OpenUI React packages, Streamdown, Shiki, Recharts, and the protocol workspace. It owns Fleet presentation, not runtime access.
• web/protocol (@prime-agent/web-protocol) depends on Zod, @asteasolutions/zod-to-openapi, and OpenUI language types. It exports the browser-safe contract.
• web/server (@prime-agent/web-server) depends on prime-agent, @earendil-works/pi-agent-core, @earendil-works/pi-ai, and the protocol workspace. It is the only package that imports the engine.
• packages/fleet-web (@qredence/fleet) depends on the same three runtime-family tarballs plus React, React DOM, and use-sync-external-store so a global install is self-contained.

The exact dependency ranges and package allowlist are in the package manifests. The resolved versions belong in pnpm-lock.yaml.

Pinned Prime Agent runtime

PRIME_AGENT_RUNTIME.json currently records:

{
  "package": "prime-agent",
  "version": "0.9.1",
  "tarball": "https://pub-728493de92a943e2a9b2d17b4719f318.r2.dev/releases/v0.9.1/prime-agent-0.9.1.tgz",
  "sha256": "573bce0cd004fc62052e9a924089941b7f39266ab71e66a94c85a1f9d35835ba"
}

The same release-family URLs appear in web/server/package.json and packages/fleet-web/package.json. scripts/check-prime-agent-runtime.mjs cross-checks the manifest, both package pins, and the lockfile specifier and integrity. With PRIME_RUNTIME_VERIFY_TARBALL=1, it downloads the archive and checks both SHA-256 and lockfile SHA-512 values.

This exact runtime identity is what the daemon protocol compatibility check protects. Fleet does not vendor, patch, or republish the engine.

Workspace policy

pnpm-workspace.yaml enforces:

• minimumReleaseAge: 10080, a seven-day soak period;
• trustPolicy: no-downgrade;
• blockExoticSubdeps: false for the upstream runtime's pinned R2 dependencies;
• allowBuilds for trusted install scripts such as esbuild, zeromq, prime-agent, Biome, the TypeScript native preview, OpenUI language core, and better-sqlite3;
• explicit install-script denial for @google/genai, koffi, protobufjs, and other packages that do not need to build in this workspace.

Dependabot's weekly npm and GitHub Actions updates use a matching seven-day cooldown in .github/dependabot.yml. The workspace excludes a small set of known trust-downgrade lockfile entries: @pierre/theme@2.0.0, semver@5.7.2, semver@6.3.1, and undici-types@6.21.0.

Explicit overrides

The overrides in pnpm-workspace.yaml document their reasons:

Override	Reason
rimraf and gaxios>rimraf 6.1.2	Keep the transitive cleanup dependency on the patched version
shell-quote ^1.10.0	Security pin
nanoid ^3.3.18	Addresses GHSA-2v37-7h3g-55p8 through postcss
cytoscape 3.34.0	Avoid a release that lost provenance
shiki 4.4.2	Unify the type surface used by Streamdown and diff rendering
rolldown 1.2.4	Preserve the client chunk graph accepted by the bundle contract

Remove an override only after the reason no longer applies and the relevant checks pass.

Bundle dependency constraint

web/app/scripts/check-bundle-budget.mjs treats dependency chunking as a contract. A fresh build must have one route entry, reduce that entry by at least 30% from the 1,058,534-byte gzip baseline, keep the eager graph at or below 450 KiB and within 5% of the accepted 352,192-byte graph, and keep OpenUI, settings, markdown-code, artifact, resource, session-insights, and workspace panel chunks out of the eager graph. Recharts and Shiki implementation code must also stay out of that graph.

Known upstream advisory

The current lockfile still resolves extract-zip 2.0.1 through the pinned Prime Agent dependency tree. GHSA-jmr9-qjv8-65gv describes unvalidated symlink path traversal in that package. No patched release is available in the upstream package line, so Fleet cannot repair it with an override. Recheck the advisory whenever PRIME_AGENT_RUNTIME.json changes and follow docs/guides/upstream-runtime.md before adopting a new runtime.