From bf0e76a2b6e4f78a1b0f41da7fc61c8b6041f631 Mon Sep 17 00:00:00 2001 From: Merge Date: Fri, 10 Jul 2026 21:45:11 -0400 Subject: [PATCH 1/2] chore(agent-client): update codex app server protocol --- .changeset/quiet-protocol-cameras.md | 5 +++++ packages/agent-client/package.json | 2 +- pnpm-lock.yaml | 12 +++++++----- 3 files changed, 13 insertions(+), 6 deletions(-) create mode 100644 .changeset/quiet-protocol-cameras.md diff --git a/.changeset/quiet-protocol-cameras.md b/.changeset/quiet-protocol-cameras.md new file mode 100644 index 0000000..76187dd --- /dev/null +++ b/.changeset/quiet-protocol-cameras.md @@ -0,0 +1,5 @@ +--- +"@pwrdrvr/agent-client": patch +--- + +Update @pwrdrvr/codex-app-server-protocol to 0.135.0. diff --git a/packages/agent-client/package.json b/packages/agent-client/package.json index 99e9425..520e3e9 100644 --- a/packages/agent-client/package.json +++ b/packages/agent-client/package.json @@ -25,8 +25,8 @@ "dependencies": { "@pwrdrvr/agent-core": "workspace:^", "@pwrdrvr/agent-transport": "workspace:^", + "@pwrdrvr/codex-app-server-protocol": "^0.135.0", "@pwrdrvr/codex-discovery": "workspace:^", - "@pwrdrvr/codex-app-server-protocol": "^0.133.0", "zod": "^4.0.0" }, "devDependencies": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index d538c17..d9e3eef 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -7,6 +7,8 @@ settings: overrides: zod: ^4.0.0 +pnpmfileChecksum: sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU= + importers: .: @@ -105,8 +107,8 @@ importers: specifier: workspace:^ version: link:../agent-transport '@pwrdrvr/codex-app-server-protocol': - specifier: ^0.133.0 - version: 0.133.0 + specifier: ^0.135.0 + version: 0.135.0 '@pwrdrvr/codex-discovery': specifier: workspace:^ version: link:../codex-discovery @@ -592,8 +594,8 @@ packages: resolution: {integrity: sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==} engines: {node: '>= 8'} - '@pwrdrvr/codex-app-server-protocol@0.133.0': - resolution: {integrity: sha512-mt+geA0RZEz5A3kEK8poDE3wYDrteWGb2syfXS4/kzzgWEe26DUbQlbdQyFYoa7Zs/Z6L64gNGIfFHgemfzj8g==} + '@pwrdrvr/codex-app-server-protocol@0.135.0': + resolution: {integrity: sha512-lmebPpbmaE7yfe0EDqcT2MPRtKurUc1o9NinHAVdA3lBdF3c8ZK3okiHIw6r6GEQLqOTd+7dpEuPsk4a1dEpkw==} engines: {node: '>=20'} '@rollup/rollup-android-arm-eabi@4.60.4': @@ -2241,7 +2243,7 @@ snapshots: '@nodelib/fs.scandir': 2.1.5 fastq: 1.20.1 - '@pwrdrvr/codex-app-server-protocol@0.133.0': {} + '@pwrdrvr/codex-app-server-protocol@0.135.0': {} '@rollup/rollup-android-arm-eabi@4.60.4': optional: true From 579d9f0b8bdf5e6a1564ac1663b404bf196d2e0b Mon Sep 17 00:00:00 2001 From: Merge Date: Sat, 11 Jul 2026 01:22:11 -0400 Subject: [PATCH 2/2] fix(ci): make pnpmfile checksum portable --- ...md => update-codex-app-server-protocol.md} | 0 .github/workflows/ci.yml | 2 +- .github/workflows/release.yml | 2 +- .npmrc | 5 ++ .pnpmfile.cjs | 61 +++++++++++++++++++ pnpm-lock.yaml | 2 +- 6 files changed, 69 insertions(+), 3 deletions(-) rename .changeset/{quiet-protocol-cameras.md => update-codex-app-server-protocol.md} (100%) create mode 100644 .npmrc create mode 100644 .pnpmfile.cjs diff --git a/.changeset/quiet-protocol-cameras.md b/.changeset/update-codex-app-server-protocol.md similarity index 100% rename from .changeset/quiet-protocol-cameras.md rename to .changeset/update-codex-app-server-protocol.md diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 021c11d..91f8926 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,7 +22,7 @@ jobs: cache: pnpm - name: Install - run: pnpm install --frozen-lockfile --ignore-pnpmfile + run: pnpm install --frozen-lockfile - name: License policy run: pnpm lint:licenses diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f4e9f11..76709ee 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -45,7 +45,7 @@ jobs: run: npm install -g npm@11 - name: Install - run: pnpm install --frozen-lockfile --ignore-pnpmfile + run: pnpm install --frozen-lockfile - name: Build run: pnpm build diff --git a/.npmrc b/.npmrc new file mode 100644 index 0000000..e3c3270 --- /dev/null +++ b/.npmrc @@ -0,0 +1,5 @@ +# Force pnpm to ignore any user-level global-pnpmfile when running +# inside this repo. The repo-level .pnpmfile.cjs is the only hook that +# should affect pnpmfileChecksum, so frozen installs behave the same +# on contributor machines and in CI. +global-pnpmfile= diff --git a/.pnpmfile.cjs b/.pnpmfile.cjs new file mode 100644 index 0000000..a248742 --- /dev/null +++ b/.pnpmfile.cjs @@ -0,0 +1,61 @@ +'use strict' + +const dependencyFields = [ + 'dependencies', + 'optionalDependencies', + 'peerDependencies', +] + +const firstPartyPackageNames = new Set([ + '@pwrdrvr/agent-kit-root', + 'minimal-consumer', +]) +const firstPartyPackagePrefix = '@pwrdrvr/' + +function isFirstParty(pkg) { + if (!pkg || typeof pkg.name !== 'string') return false + if (firstPartyPackageNames.has(pkg.name)) return true + return pkg.name.startsWith(firstPartyPackagePrefix) +} + +const gitSpecPattern = /^(?:git(?:\+|:)|git@|ssh:\/\/git@|github:|gitlab:|bitbucket:|https?:\/\/(?:www\.)?(?:github|gitlab|bitbucket)\.com\/|[^/@\s]+\/[^/\s]+(?:#.*)?$)/ + +function isGitSpec(spec) { + return typeof spec === 'string' && gitSpecPattern.test(spec) +} + +function scanField(pkg, field) { + const dependencies = pkg[field] + if (!dependencies) return + for (const [name, spec] of Object.entries(dependencies)) { + if (isGitSpec(spec)) { + throw new Error(`Blocked git dependency ${name}@${spec} (in ${pkg.name ?? ''}.${field})`) + } + } +} + +function readPackage(pkg) { + for (const field of dependencyFields) { + scanField(pkg, field) + } + if (isFirstParty(pkg)) { + scanField(pkg, 'devDependencies') + } + return pkg +} + +function blockGitFetcher() { + return async () => { + throw new Error('Blocked pnpm git dependency fetch') + } +} + +module.exports = { + hooks: { + readPackage, + fetchers: { + git: blockGitFetcher, + gitHostedTarball: blockGitFetcher, + }, + }, +} diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index d9e3eef..b21982f 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -7,7 +7,7 @@ settings: overrides: zod: ^4.0.0 -pnpmfileChecksum: sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU= +pnpmfileChecksum: sha256-nSeLKzq5FAIkAHHxqmAwTobjeMQDJ2T2n/c5eU3xkpo= importers: