Tianyi Cui
d9f6afebb1
pnpm 11.7.0 can finish its work, print `Done in Xs`, and then never exit (pnpm/pnpm#12297, pnpm/pnpm#13617): finishWorkers() clears the worker pool reference, and a later worker API call recreates a pool that is never finished, so idle worker threads keep the event loop alive. The upstream fix (pnpm/pnpm#13226) shipped in 11.23.0, and 11.25.0 fixed the hoisted-linker rename race as well. The hang surfaces in this repository as a packed-profile rehearsal that runs `pnpm remove` through the plugin manager and then waits for the test deadline, holding the profile write lock for the whole time. Bump packageManager and devDependencies.pnpm in the root, the pinned pnpm in apps/desktop, and the native/system packageManager; relock; exempt the fresh package manager from the release-age window; follow the development guide pair.
111 lines
5.4 KiB
YAML
111 lines
5.4 KiB
YAML
packages:
|
|
- vendor/*
|
|
- packages/*/*
|
|
# The Landlock launcher is developed with its harness consumers but keeps
|
|
# its native build and publication scripts under native/system.
|
|
- native/system
|
|
- native/system/packages/*
|
|
# Product assemblies over the package tier; apps/cli owns the `dsh` bin.
|
|
- apps/*
|
|
# Private package owning repository-level benchmark dependencies.
|
|
- benchmarks
|
|
- website
|
|
# Deploy root of the single-exe build: a pure dependency manifest whose
|
|
# closure is what the exe bundles and what the Python runtime distributes.
|
|
- python/sdk-runtime
|
|
|
|
overrides:
|
|
'extract-zip>yauzl': '3.4.0'
|
|
'@deepseek-ai/cosmokit': 'link:vendor/cosmokit'
|
|
'@deepseek-ai/schemastery': 'link:vendor/schemastery'
|
|
|
|
peerDependencyRules:
|
|
allowedVersions:
|
|
typescript: '>=5 <7'
|
|
|
|
# pnpm 10+ blocks any dependency shipping an install/build script until it is
|
|
# explicitly reviewed here (strictDepBuilds defaults to true: an unlisted script
|
|
# is a hard install error). Every such package MUST be listed; we deny by
|
|
# default and only allow scripts we need. esbuild (native binary) and lefthook
|
|
# (git hooks) genuinely need theirs.
|
|
allowBuilds:
|
|
esbuild: true
|
|
lefthook: true
|
|
# Cross-platform boundary for the persistent PTY backend, including ConPTY on Windows.
|
|
node-pty: true
|
|
# Pulled in by @earendil-works/pi-ai (optional LLM API backend). pnpm lists
|
|
# them only because they ship lifecycle scripts, but those are no-ops we don't
|
|
# need, so we deny them — install still succeeds.
|
|
'@google/genai': false
|
|
protobufjs: false
|
|
node-addon-require-builtin: false
|
|
# JSONL durability calls MoveFileExW with write-through publication on Windows.
|
|
# Consumers pin 3.1.1: Koffi 3.3.2's source build fails under GCC 13 when
|
|
# optional prebuilts are omitted. Upgrade all consumers together after the
|
|
# replacement passes that build and the release packed-install check.
|
|
koffi: true
|
|
# The Python runtime deploy includes the reviewed workspace postinstall that
|
|
# restores the executable bit on node-pty's macOS spawn helper.
|
|
'@deepseek-ai/dsh-subprocess-local@file:packages/subprocess/subprocess-local': true
|
|
# electron-builder pulls in the optional Squirrel.Windows helper, whose
|
|
# install script only selects its bundled 7-Zip executable. Desktop ships
|
|
# Windows through NSIS, so that mutation is not part of our build.
|
|
electron-winstaller: false
|
|
# Store-index rewriting only needs msgpackr's portable JavaScript codec.
|
|
msgpackr-extract: false
|
|
|
|
minimumReleaseAgeExclude:
|
|
# Office engines and their API are qualified and released together by the kit repository.
|
|
- '@deepseek-ai/[email protected]'
|
|
- '@deepseek-ai/[email protected]'
|
|
- '@deepseek-ai/[email protected]'
|
|
- '@deepseek-ai/[email protected]'
|
|
- '@deepseek-ai/[email protected]'
|
|
- '@deepseek-ai/[email protected]'
|
|
# Fresh pi-ai releases carry the model catalog updates that are the whole
|
|
# point of bumping it; waiting out the release age would defeat that.
|
|
- '@earendil-works/[email protected]'
|
|
- '@earendil-works/[email protected]'
|
|
- [email protected]
|
|
- [email protected]
|
|
- [email protected]
|
|
- [email protected]
|
|
- [email protected]
|
|
- [email protected]
|
|
- [email protected]
|
|
- [email protected]
|
|
- [email protected]
|
|
# The active pnpm supply-chain policy blocks this reviewed runtime closure
|
|
# until its release-age window expires unless every exact package is exempt.
|
|
- '@anthropic-ai/[email protected]'
|
|
- '@anthropic-ai/[email protected]'
|
|
- '@anthropic-ai/[email protected]'
|
|
- '@anthropic-ai/[email protected]'
|
|
- '@anthropic-ai/[email protected]'
|
|
- '@anthropic-ai/[email protected]'
|
|
- '@anthropic-ai/[email protected]'
|
|
- '@anthropic-ai/[email protected]'
|
|
- '@anthropic-ai/[email protected]'
|
|
# All platform aliases resolve to the @openai/codex package name, so their
|
|
# reviewed exact versions must share one version-union policy entry.
|
|
- '@openai/[email protected]||0.153.4-darwin-arm64||0.153.4-darwin-x64||0.153.4-linux-arm64||0.153.4-linux-x64||0.153.4-win32-arm64||0.153.4-win32-x64'
|
|
# The native computer-use provider pins this reviewed upstream runtime closure.
|
|
- '@trycua/[email protected]'
|
|
- '@trycua/[email protected]'
|
|
- '@trycua/[email protected]'
|
|
- '@trycua/[email protected]'
|
|
- '@trycua/[email protected]'
|
|
- '@trycua/[email protected]'
|
|
- '@trycua/[email protected]'
|
|
# The package manager is a workspace devDependency, so its own exact pin
|
|
# must be exempt from the release-age window that guards other packages.
|
|
- [email protected]
|
|
patchedDependencies:
|
|
'@earendil-works/[email protected]': patches/@[email protected]
|
|
'@electron/[email protected]': patches/@[email protected]
|
|
'@fortune-sheet/[email protected]': patches/@[email protected]
|
|
'@fortune-sheet/[email protected]': patches/@[email protected]
|
|
'@yao-pkg/[email protected]': patches/@[email protected]
|
|
[email protected]: patches/[email protected]
|
|
[email protected]: patches/[email protected]
|