packages: - vendor/* - packages/*/* # The Landlock launcher is developed with its harness consumers but keeps # its native build and publication scripts under native/system. - native/system - native/system/packages/* # Product assemblies over the package tier; apps/cli owns the `dsh` bin. - apps/* # Private package owning repository-level benchmark dependencies. - benchmarks - website # Deploy root of the single-exe build: a pure dependency manifest whose # closure is what the exe bundles and what the Python runtime distributes. - python/sdk-runtime overrides: 'extract-zip>yauzl': '3.4.0' '@deepseek-ai/cosmokit': 'link:vendor/cosmokit' '@deepseek-ai/schemastery': 'link:vendor/schemastery' peerDependencyRules: allowedVersions: typescript: '>=5 <7' # pnpm 10+ blocks any dependency shipping an install/build script until it is # explicitly reviewed here (strictDepBuilds defaults to true: an unlisted script # is a hard install error). Every such package MUST be listed; we deny by # default and only allow scripts we need. esbuild (native binary) and lefthook # (git hooks) genuinely need theirs. allowBuilds: esbuild: true lefthook: true # Cross-platform boundary for the persistent PTY backend, including ConPTY on Windows. node-pty: true # Pulled in by @earendil-works/pi-ai (optional LLM API backend). pnpm lists # them only because they ship lifecycle scripts, but those are no-ops we don't # need, so we deny them — install still succeeds. '@google/genai': false protobufjs: false node-addon-require-builtin: false # JSONL durability calls MoveFileExW with write-through publication on Windows. # Consumers pin 3.1.1: Koffi 3.3.2's source build fails under GCC 13 when # optional prebuilts are omitted. Upgrade all consumers together after the # replacement passes that build and the release packed-install check. koffi: true # The Python runtime deploy includes the reviewed workspace postinstall that # restores the executable bit on node-pty's macOS spawn helper. '@deepseek-ai/dsh-subprocess-local@file:packages/subprocess/subprocess-local': true # electron-builder pulls in the optional Squirrel.Windows helper, whose # install script only selects its bundled 7-Zip executable. Desktop ships # Windows through NSIS, so that mutation is not part of our build. electron-winstaller: false # Store-index rewriting only needs msgpackr's portable JavaScript codec. msgpackr-extract: false minimumReleaseAgeExclude: # Native Codex and Claude tests qualify this exact release with its local patches. - '@botiverse/oar@0.67.0' # Office engines and their API are qualified and released together by the kit repository. - '@deepseek-ai/libreoffice-kit@0.1.5' - '@deepseek-ai/libreoffice-kit-darwin-arm64@0.1.5' - '@deepseek-ai/libreoffice-kit-darwin-x64@0.1.5' - '@deepseek-ai/libreoffice-kit-win32-arm64@0.1.5' - '@deepseek-ai/libreoffice-kit-win32-x64@0.1.5' - '@deepseek-ai/libreoffice-kit-wasm@0.1.5' # Fresh pi-ai releases carry the model catalog updates that are the whole # point of bumping it; waiting out the release age would defeat that. - '@earendil-works/pi-ai@1.3.0' - '@earendil-works/pi-telemetry@1.3.0' # This addon release recognizes the Electron 44.7.0 Node/V8 fingerprint used by Desktop. - node-addon-native-custom-loader@0.1.9 - node-addon-require-builtin-darwin-arm64@0.1.9 - node-addon-require-builtin-darwin-x64@0.1.9 - node-addon-require-builtin-linux-arm64-gnu@0.1.9 - node-addon-require-builtin-linux-x64-gnu@0.1.9 - node-addon-require-builtin-linux-arm64-musl@0.1.9 - node-addon-require-builtin-linux-x64-musl@0.1.9 - node-addon-require-builtin-win32-arm64-msvc@0.1.9 - node-addon-require-builtin-win32-ia32-msvc@0.1.9 - node-addon-require-builtin-win32-x64-msvc@0.1.9 - node-addon-require-builtin@0.1.9 # The active pnpm supply-chain policy blocks this reviewed runtime closure # until its release-age window expires unless every exact package is exempt. - '@anthropic-ai/claude-agent-sdk-darwin-arm64@0.3.263' - '@anthropic-ai/claude-agent-sdk-darwin-x64@0.3.263' - '@anthropic-ai/claude-agent-sdk-linux-arm64-musl@0.3.263' - '@anthropic-ai/claude-agent-sdk-linux-arm64@0.3.263' - '@anthropic-ai/claude-agent-sdk-linux-x64-musl@0.3.263' - '@anthropic-ai/claude-agent-sdk-linux-x64@0.3.263' - '@anthropic-ai/claude-agent-sdk-win32-arm64@0.3.263' - '@anthropic-ai/claude-agent-sdk-win32-x64@0.3.263' - '@anthropic-ai/claude-agent-sdk@0.3.263' # All platform aliases resolve to the @openai/codex package name, so their # reviewed exact versions must share one version-union policy entry. - '@openai/codex@0.153.4||0.153.4-darwin-arm64||0.153.4-darwin-x64||0.153.4-linux-arm64||0.153.4-linux-x64||0.153.4-win32-arm64||0.153.4-win32-x64' # The native computer-use provider pins this reviewed upstream runtime closure. - '@trycua/cua-driver-darwin-arm64@0.28.0' - '@trycua/cua-driver-darwin-x64@0.28.0' - '@trycua/cua-driver-linux-arm64-gnu@0.28.0' - '@trycua/cua-driver-linux-x64-gnu@0.28.0' - '@trycua/cua-driver-win32-arm64-msvc@0.28.0' - '@trycua/cua-driver-win32-x64-msvc@0.28.0' - '@trycua/cua-driver@0.28.0' # The package manager is a workspace devDependency, so its own exact pin # must be exempt from the release-age window that guards other packages. - pnpm@11.28.5 # Desktop packaging requires this Electron fingerprint with node-addon-require-builtin 0.1.9. - electron@44.7.0 patchedDependencies: '@botiverse/oar@0.67.0': patches/@botiverse__oar@0.67.0.patch '@earendil-works/pi-ai@1.3.0': patches/@earendil-works__pi-ai@1.3.0.patch '@electron/osx-sign@1.3.3': patches/@electron__osx-sign@1.3.3.patch '@fortune-sheet/core@1.0.4': patches/@fortune-sheet__core@1.0.4.patch '@fortune-sheet/react@1.0.4': patches/@fortune-sheet__react@1.0.4.patch '@yao-pkg/pkg@6.21.0': patches/@yao-pkg__pkg@6.21.0.patch app-builder-lib@26.17.0: patches/app-builder-lib@26.17.0.patch exceljs@4.4.0: patches/exceljs@4.4.0.patch lexical@0.49.0: patches/lexical@0.49.0.patch node-pty@1.2.0-beta.15: patches/node-pty@1.2.0-beta.15.patch