omi/desktop/windows/pnpm-workspace.yaml at main · ghzhost/omi · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
# jiti/glob/minimatch/hosted-git-info/ignore/semver pinned to a single version each,
# workspace-wide: @earendil-works/pi-coding-agent needs jiti@2.7.0, glob@13.0.6,
# minimatch@10.2.5, hosted-git-info@9.0.3, ignore@7.0.5, semver@7.8.0 as real runtime
# dependencies, but electron-builder's own toolchain (app-builder-lib, builder-util,
# @electron/asar, @electron/get, @electron/universal, dir-compare, node-gyp, …) and
# eslint/@babel/@typescript-eslint pull in much older versions of the SAME package names
# as their own (dev-only, never-shipped) deps. pnpm's hoisted layout keeps both — one
# nested under pi-coding-agent, one flat at top-level — which is fine for dev, but
# electron-builder's asar packing collapses same-named node_modules entries to one
# `node_modules/<name>` and (empirically, reproducibly) keeps the OLD flat one, discarding
# the nested copy pi-coding-agent actually needs. That silently broke the packaged app's
# AI chat at runtime with a chain of `ERR_MODULE_NOT_FOUND`/`SyntaxError: Named export ...
# not found` errors (jiti's "./static" subpath only exists in 2.x; glob/minimatch's named
# ESM exports only exist in their modern majors) — confirmed by spawning the actual
# packaged pi-coding-agent CLI the same way src/main/codingAgent/piMono.ts does. Every
# other consumer of the old versions is exclusively dev/build-time tooling that never
# ships in the packaged app (electron-builder, eslint, babel, typescript-eslint), except
# electron-updater's semver@7.7.4 need — 7.8.0 is a same-major minor bump, safe. This
# removes the duplicate instead of picking a side; deliberately does NOT include `chalk`
# (also collides, 4.1.2 vs pi-coding-agent's 5.6.2) because chalk 5 is ESM-only and would
# break electron-builder/eslint's CJS `require('chalk')` — needs its own targeted fix if
# it turns out to actually matter for pi-coding-agent's runtime behavior.
overrides:
  '@hono/node-server': '~2.0.5'
  adm-zip: '>=0.5.16'
  app-builder-lib: '~26.15.0'
  axios: '~1.18.0'
  'brace-expansion@5.0.6': '~5.0.8'
  builder-util-runtime: '~9.7.0'
  esbuild: '>=0.28.1'
  fast-uri: '~3.1.4'
  form-data: '>=4.0.6'
  hosted-git-info: '9.0.3'
  ignore: '7.0.5'
  jiti: '2.7.0'
  js-yaml: '~4.3.0'
  glob: '13.0.6'
  minimatch: '10.2.5'
  postcss: '~8.5.18'
  protobufjs: '>=7.6.3'
  semver: '7.8.0'
  tar: '~7.5.18'
  undici: '>=7.28.0'
  websocket-driver: '>=0.7.5'

allowBuilds:
  '@firebase/util': true
  better-sqlite3: true
  electron: true
  electron-winstaller: true
  esbuild: true
  koffi: true
  onnxruntime-node: true
  protobufjs: true
  sharp: true
# Deliberate, narrow exception to pnpm's minimumReleaseAge supply-chain
# quarantine (not an accidental relaxation) — reviewed and accepted for the
# coding-agent adapter feature (desktop/windows/src/main/codingAgent/).
#
# Why these specific packages: they are the runtime closure of the bundled
# Claude Code ACP bridge — @agentclientprotocol/claude-agent-acp (the
# official ACP org's maintained package, successor to the now-deprecated
# @zed-industries/claude-agent-acp) and its @anthropic-ai/claude-agent-sdk
# native platform binaries — all published by the same first-party,
# reputable maintainers (Anthropic / the Agent Client Protocol org), not
# unknown/anonymous publishers. Freshness (not age) is the only reason they'd
# otherwise be quarantined.
#
# Why this is self-limiting, not a standing bypass: entries are pinned to
# EXACT versions, matching what's actually installed (see package.json).
# Bumping any of these packages later requires updating this list too —
# pnpm re-quarantines any version not explicitly listed here.
minimumReleaseAgeExclude:
  - '@agentclientprotocol/claude-agent-acp@0.58.1'
  - '@anthropic-ai/claude-agent-sdk-darwin-arm64@0.3.205'
  - '@anthropic-ai/claude-agent-sdk-darwin-x64@0.3.205'
  - '@anthropic-ai/claude-agent-sdk-linux-arm64-musl@0.3.205'
  - '@anthropic-ai/claude-agent-sdk-linux-arm64@0.3.205'
  - '@anthropic-ai/claude-agent-sdk-linux-x64-musl@0.3.205'
  - '@anthropic-ai/claude-agent-sdk-linux-x64@0.3.205'
  - '@anthropic-ai/claude-agent-sdk-win32-arm64@0.3.205'
  - '@anthropic-ai/claude-agent-sdk-win32-x64@0.3.205'
  - '@anthropic-ai/claude-agent-sdk@0.3.205'
  - react-router-dom@7.18.2
  - react-router@7.18.2