From 287b04d72f1b9fca1412e05435c75b8302ba0710 Mon Sep 17 00:00:00 2001 From: Dotta <34892728+cryppadotta@users.noreply.github.com> Date: Wed, 28 Oct 2026 15:30:58 -0500 Subject: [PATCH] fix(evals): keep report dependency proof with lockfile refresh (#18063) https://entire.com/gh/paperclipai/-/trails/192/changes/paperclip/192 ## Thinking Path > - Paperclip manages AI agents and runs paid Product E2E evaluations. > - Paid work needs a report that can install its trusted dependencies. > - The report uses a reviewed offline lock correction. > - New UI dependencies can make that correction stale while its lock hash still matches. > - The lockfile bot must refresh the correction with its lock changes. > - This PR also checks manifest consistency offline before model admission. ## Linked Issues or Issue Description **What happened?** Current master declares new CodeMirror and YAML UI dependencies. Its committed lock omits those UI importer entries. The existing report correction accepts that lock, but a frozen install then fails with `ERR_PNPM_OUTDATED_LOCKFILE`. This can waste completed paid work before the report fails. Refs #18059. That bot PR supplies the matching lock. This PR keeps the root lock bot-owned and supplies its exact offline report correction. The correction changes 21 importer lines and leaves all package records unchanged. **Expected behavior** The existing bot includes matching report proof in its dependency PR. Paid authorization rejects stale manifests before model work. Report installation still accepts only reviewed hashes and applies no registry resolution. **Steps to reproduce** 1. Run a frozen pnpm 9.15.4 install on master at `7f10cc058568e3c1ac133cf24f3b4000cbdfca0e`. 2. Observe the missing UI importer entries. 3. Apply the reviewed correction in this PR. The frozen install passes. ## What Changed - Add an explicit refresh mode that derives the offline patch and hashes from a known committed lock and the bot's resolved lock. - Keep the existing unknown-lock, patch hash and output hash guards. - Include the proof files in the existing lockfile bot PR. New bot PRs use complete descriptions; existing descriptions stay intact. - Validate the frozen lock against current manifests offline before paid admission, using the existing pinned pnpm version. - Refresh the current correction and document this process. The root lockfile is not committed here. ## Verification - 24 focused report-lock and workflow-security tests pass. They cover offline replay, tampered input/patch/output rejection, real Git refresh, unknown-base refusal and unchanged proof. - A full frozen install passes after the reviewed correction, with lifecycle scripts disabled. - A fresh source archive validates offline with an empty package store. - A deliberate manifest change fails that same offline check with `ERR_PNPM_OUTDATED_LOCKFILE`. - Both workflow files parse as YAML. All 95 shell steps pass Bash syntax checks. - `git diff --check` passes. These checks make no model requests. - Full repository checks and fresh reviews must pass on the final PR head before merge. ## Risks - Dependency changes must still pass review. Refresh refuses an unknown committed baseline. - The bot now commits two additional proof files. Its write permissions and target branch stay unchanged. Existing PR descriptions are preserved. - The paid authorization job adds an offline manifest check. It runs no package lifecycle scripts. - No budget, provider credential, environment permission, schedule or paid enable gate changes. ## Model Used - OpenAI Codex, GPT-6, with reasoning and code execution tools. The exact serving variant and context window are not exposed in this session. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [ ] All Paperclip CI gates are green - [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip --- .github/workflows/refresh-lockfile.yml | 59 +- .github/workflows/runner-full-stack-e2e.yml | 12 + tests/runner-e2e/OPERATIONS.md | 12 +- tests/runner-e2e/prepare-report-lock.d.mts | 1 + tests/runner-e2e/prepare-report-lock.mjs | 25 +- tests/runner-e2e/prepare-report-lock.test.ts | 66 +- tests/runner-e2e/report-lock.json | 8 +- tests/runner-e2e/report-lock.patch | 655 ++----------------- tests/runner-e2e/workflow-security.test.ts | 12 +- 9 files changed, 217 insertions(+), 633 deletions(-) diff --git a/.github/workflows/refresh-lockfile.yml b/.github/workflows/refresh-lockfile.yml index ecc0c73ebee..59f47b01531 100644 --- a/.github/workflows/refresh-lockfile.yml +++ b/.github/workflows/refresh-lockfile.yml @@ -39,6 +39,9 @@ jobs: - name: Refresh pnpm lockfile run: pnpm install --resolution-only --ignore-scripts --no-frozen-lockfile + - name: Refresh reviewed eval report dependency proof + run: node tests/runner-e2e/prepare-report-lock.mjs --refresh + - name: Fail on unexpected file changes run: | changed="$(git status --porcelain)" @@ -46,7 +49,8 @@ jobs: echo "Lockfile is already up to date." exit 0 fi - if printf '%s\n' "$changed" | grep -Fvq ' pnpm-lock.yaml'; then + unexpected="$(printf '%s\n' "$changed" | awk '$2 != "pnpm-lock.yaml" && $2 != "tests/runner-e2e/report-lock.json" && $2 != "tests/runner-e2e/report-lock.patch" { print }')" + if [ -n "$unexpected" ]; then echo "Unexpected files changed during lockfile refresh:" echo "$changed" exit 1 @@ -69,7 +73,7 @@ jobs: git config user.email "lockfile-bot@users.noreply.github.com" git checkout -B "$BRANCH" - git add pnpm-lock.yaml + git add pnpm-lock.yaml tests/runner-e2e/report-lock.json tests/runner-e2e/report-lock.patch git commit -m "chore(lockfile): refresh pnpm-lock.yaml" git push --force origin "$BRANCH" @@ -80,10 +84,59 @@ jobs: head -n 1 )" if [ -z "$pr_url" ]; then + pr_body_file="$RUNNER_TEMP/lockfile-pr-body.md" + cat > "$pr_body_file" <<'PR_BODY' + ## Thinking Path + + > - Paperclip uses a dependency lock for reproducible builds. + > - Dependency changes on master need matching lock entries. + > - Paid eval reports also pin a reviewed offline correction. + > - Reports must install before paid model work starts. + > - This automated PR keeps the lock and report proof together. + + ## Linked Issues or Issue Description + + **What happened?** + + Dependency manifests on master changed after the last committed lock refresh. + + **Expected behavior** + + Frozen installs must match those manifests. Eval reports must retain matching offline lock proof. + + **Steps to reproduce** + + Run a frozen install before and after this lock refresh. + + ## What Changed + + - Refresh the dependency lock from the manifests on master. + - Include the matching offline report correction and hashes. + + ## Verification + + - Pinned pnpm resolution completed with lifecycle scripts disabled. + - The report proof refresh accepted the reviewed committed baseline. + - Required PR checks and reviews must pass before merge. + + ## Risks + + Dependency changes require review. Unknown report lock baselines remain blocked. This update changes no permissions or paid enable gates. + + ## Model Used + + None — generated by pnpm and the deterministic report-lock updater. + + ## Checklist + + - [x] Thinking path and problem description included + - [x] Generated lock and matching report proof included + - [ ] Required CI checks and reviews pass + PR_BODY pr_url="$(gh pr create \ --head "$BRANCH" \ --title "chore(lockfile): refresh pnpm-lock.yaml" \ - --body "Auto-generated lockfile refresh after dependencies changed on master. This PR only updates pnpm-lock.yaml.")" + --body-file "$pr_body_file")" echo "Created new PR: $pr_url" else echo "PR already exists: $pr_url" diff --git a/.github/workflows/runner-full-stack-e2e.yml b/.github/workflows/runner-full-stack-e2e.yml index c1a402d1a4c..fcac6ebf260 100644 --- a/.github/workflows/runner-full-stack-e2e.yml +++ b/.github/workflows/runner-full-stack-e2e.yml @@ -196,9 +196,21 @@ jobs: with: node-version: 24 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 + env: + NPM_CONFIG_AUDIT: "false" + NPM_CONFIG_FUND: "false" + NPM_CONFIG_UPDATE_NOTIFIER: "false" + with: + version: 9.15.4 + run_install: false + - name: Preflight reviewed report dependencies before paid admission run: node tests/runner-e2e/prepare-report-lock.mjs + - name: Validate report dependency manifests offline + run: pnpm install --lockfile-only --frozen-lockfile --ignore-scripts --offline + target_lock: name: Resolve target pnpm lockfile needs: authorize diff --git a/tests/runner-e2e/OPERATIONS.md b/tests/runner-e2e/OPERATIONS.md index e193652ba13..732ef2ca680 100644 --- a/tests/runner-e2e/OPERATIONS.md +++ b/tests/runner-e2e/OPERATIONS.md @@ -976,11 +976,17 @@ install. `report-lock.json` pins the input lock, patch and resulting lock hashes This updates existing patch identities and the already declared yaml dependency without registry resolution. The worker target and its lock artifact never control report dependencies. An already-reviewed output lock is used unchanged. An unknown committed lock fails before install; -update and review this correction when dependency inputs change. The original +review the correction with dependency changes. The existing lockfile-refresh bot runs +`prepare-report-lock.mjs --refresh` and includes the correction and hashes in its +lockfile PR. The PR includes the root lock, which is owned by CODEOWNERS; +the bot requests normal auto-merge and cannot bypass required code-owner review +or checks. It refuses to bless an unrecognized committed lock. Paid authorization +and report jobs still apply only the reviewed offline correction. The original failed run remains failed when retained evidence gets a new presentation. -The trusted authorization job checks this correction before catalog/build and -paid work. Unknown dependency locks fail before model admission. Manual history +The trusted authorization job checks this correction and validates the frozen +lock against current dependency manifests offline before catalog/build and paid +work. This check resolves no packages and runs no lifecycle scripts. Unknown dependency locks fail before model admission. Manual history publication applies the same correction before its frozen install. Qualification image builds apply it only when target and workflow revisions match; a different target keeps its own lock and does not require these reporting helper files. diff --git a/tests/runner-e2e/prepare-report-lock.d.mts b/tests/runner-e2e/prepare-report-lock.d.mts index a6314304c3f..c69a6f0e43a 100644 --- a/tests/runner-e2e/prepare-report-lock.d.mts +++ b/tests/runner-e2e/prepare-report-lock.d.mts @@ -1 +1,2 @@ export function prepareReportLock(root?: string): Promise<'already-reviewed' | 'reviewed-correction'>; +export function refreshReportLock(root?: string): Promise<'unchanged' | 'refreshed'>; diff --git a/tests/runner-e2e/prepare-report-lock.mjs b/tests/runner-e2e/prepare-report-lock.mjs index 587a1428592..2916e1d4b52 100644 --- a/tests/runner-e2e/prepare-report-lock.mjs +++ b/tests/runner-e2e/prepare-report-lock.mjs @@ -26,6 +26,29 @@ export async function prepareReportLock(root = path.resolve(import.meta.dirname, return 'reviewed-correction'; } finally { await rm(temporary, { recursive: true, force: true }); } } +export async function refreshReportLock(root = path.resolve(import.meta.dirname, '../..')) { + const directory = path.join(root, 'tests/runner-e2e'); + const policyPath = path.join(directory, 'report-lock.json'); + const policy = JSON.parse(await readFile(policyPath, 'utf8')); + const committed = execFileSync('git', ['show', 'HEAD:pnpm-lock.yaml'], { cwd: root }); + const inputSha256 = sha256(committed); + if (![policy.inputSha256, policy.outputSha256].includes(inputSha256)) { + throw new Error('Committed report lock is not reviewed; refusing to refresh its proof'); + } + const resolved = await readFile(path.join(root, 'pnpm-lock.yaml')); + if (resolved.equals(committed)) return 'unchanged'; + const patch = execFileSync('git', ['diff', '--no-ext-diff', '--no-textconv', '--no-color', 'HEAD', '--', 'pnpm-lock.yaml'], { cwd: root }); + const changed = execFileSync('git', ['apply', '--numstat', '-'], { cwd: root, input: patch, encoding: 'utf8' }); + if (!/^\d+\s+\d+\s+pnpm-lock\.yaml\n$/.test(changed)) throw new Error('Report correction must change only the lockfile'); + await writeFile(path.join(directory, 'report-lock.patch'), patch); + await writeFile(policyPath, JSON.stringify({ inputSha256, outputSha256: sha256(resolved), patchSha256: sha256(patch), + basis: 'Generated with the trusted master lockfile refresh. Review this offline correction and its hashes with the dependency changes.' }, null, 2) + '\n'); + return 'refreshed'; +} + if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) { - console.log(await prepareReportLock()); + const args = process.argv.slice(2); + if (args.length === 0) console.log(await prepareReportLock()); + else if (args.length === 1 && args[0] === '--refresh') console.log(await refreshReportLock()); + else throw new Error('Usage: prepare-report-lock.mjs [--refresh]'); } diff --git a/tests/runner-e2e/prepare-report-lock.test.ts b/tests/runner-e2e/prepare-report-lock.test.ts index a13b064ec48..463a841bf26 100644 --- a/tests/runner-e2e/prepare-report-lock.test.ts +++ b/tests/runner-e2e/prepare-report-lock.test.ts @@ -1,11 +1,11 @@ -import { mkdtemp, mkdir, readFile, writeFile, copyFile, rm } from 'node:fs/promises'; +import { mkdtemp, mkdir, readFile, writeFile, copyFile, realpath, rm } from 'node:fs/promises'; import { createHash } from 'node:crypto'; import { execFileSync } from 'node:child_process'; import { tmpdir } from 'node:os'; import path from 'node:path'; import { expect, it } from 'vitest'; import { parse } from 'yaml'; -import { prepareReportLock } from './prepare-report-lock.mjs'; +import { prepareReportLock, refreshReportLock } from './prepare-report-lock.mjs'; it.each(['valid', 'unknown-lock', 'changed-patch', 'wrong-output'])( 'installs only the reviewed dependency correction: %s', async variant => { @@ -37,12 +37,15 @@ it.each(['valid', 'unknown-lock', 'changed-patch', 'wrong-output'])( expect(await prepareReportLock(root)).toBe('reviewed-correction'); expect(createHash('sha256').update(await readFile(lock)).digest('hex')).toBe(policy.outputSha256); expect(await prepareReportLock(root)).toBe('already-reviewed'); - const before = parse(input.toString()).packages; - const after = parse(await readFile(lock, 'utf8')).packages; - expect(Object.keys(after).filter(key => !Object.hasOwn(before, key))).toEqual(['yaml@2.9.1']); - for (const [key, value] of Object.entries(before)) expect(after[key]).toEqual(value); - expect(after['yaml@2.9.1'].resolution.integrity).toBe('sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw=='); - + const reviewed = parse(await readFile(lock, 'utf8')); + const ui = JSON.parse(await readFile(path.resolve(here, '../../ui/package.json'), 'utf8')); + for (const [name, specifier] of Object.entries(ui.dependencies)) { + const entry = reviewed.importers.ui.dependencies[name]; + expect(entry.specifier).toBe(specifier); + if (entry.version.startsWith('link:')) continue; + expect(reviewed.packages, name).toHaveProperty(`${name}@${entry.version.split('(')[0]}`); + expect(reviewed.snapshots, name).toHaveProperty(`${name}@${entry.version}`); + } } else { await expect(prepareReportLock(root)).rejects.toThrow(); expect(await readFile(lock)).toEqual(variant === 'unknown-lock' ? Buffer.from('unknown\n') : input); @@ -50,3 +53,50 @@ it.each(['valid', 'unknown-lock', 'changed-patch', 'wrong-output'])( } finally { await rm(root, { recursive: true, force: true }); } }, ); + + +it.each(['input', 'output', 'unknown'])('refreshes dependency proof only from a %s committed lock', async variant => { + const root = await realpath(await mkdtemp(path.join(tmpdir(), 'eval-report-lock-refresh-'))); + const relative = path.join(root, 'tests/runner-e2e'); + const original = "lockfileVersion: '9.0'\nimporters: {}\npackages:\n old@1.0.0: {resolution: {integrity: fixture-old}}\n"; + const resolved = "lockfileVersion: '9.0'\nimporters:\n ui: {}\npackages:\n added@2.0.0: {resolution: {integrity: fixture-new}}\n"; + const hash = (value: string) => createHash('sha256').update(value).digest('hex'); + try { + await mkdir(relative, { recursive: true }); + await writeFile(path.join(root, 'pnpm-lock.yaml'), original); + const initial = { inputSha256: variant === 'input' ? hash(original) : '0'.repeat(64), + outputSha256: variant === 'output' ? hash(original) : '1'.repeat(64), patchSha256: hash('historical') }; + await writeFile(path.join(relative, 'report-lock.json'), JSON.stringify(initial)); + await writeFile(path.join(relative, 'report-lock.patch'), 'historical'); + execFileSync('git', ['init', '-q'], { cwd: root }); + execFileSync('git', ['add', '.'], { cwd: root }); + execFileSync('git', ['-c', 'user.name=Fixture', '-c', 'user.email=fixture@example.invalid', 'commit', '-qm', 'fixture'], { cwd: root }); + await writeFile(path.join(root, 'pnpm-lock.yaml'), resolved); + if (variant === 'unknown') { + await expect(refreshReportLock(root)).rejects.toThrow('not reviewed'); + expect(await readFile(path.join(relative, 'report-lock.patch'), 'utf8')).toBe('historical'); + expect(JSON.parse(await readFile(path.join(relative, 'report-lock.json'), 'utf8'))).toEqual(initial); + expect(await readFile(path.join(root, 'pnpm-lock.yaml'), 'utf8')).toBe(resolved); + return; + } + if (variant === 'output') { + const cli = path.join(relative, 'prepare-report-lock.mjs'); + await copyFile(path.join(import.meta.dirname, 'prepare-report-lock.mjs'), cli); + expect(execFileSync(process.execPath, [cli, '--refresh'], { cwd: root, encoding: 'utf8' }).trim()).toBe('refreshed'); + } else { + expect(await refreshReportLock(root)).toBe('refreshed'); + } + const policy = JSON.parse(await readFile(path.join(relative, 'report-lock.json'), 'utf8')); + const patch = await readFile(path.join(relative, 'report-lock.patch'), 'utf8'); + expect(policy).toMatchObject({ inputSha256: hash(original), outputSha256: hash(resolved), patchSha256: hash(patch) }); + await writeFile(path.join(root, 'pnpm-lock.yaml'), original); + expect(await prepareReportLock(root)).toBe('reviewed-correction'); + expect(await readFile(path.join(root, 'pnpm-lock.yaml'), 'utf8')).toBe(resolved); + expect(parse(await readFile(path.join(root, 'pnpm-lock.yaml'), 'utf8')).packages).toEqual(parse(resolved).packages); + expect(await prepareReportLock(root)).toBe('already-reviewed'); + execFileSync('git', ['add', '.'], { cwd: root }); + execFileSync('git', ['-c', 'user.name=Fixture', '-c', 'user.email=fixture@example.invalid', 'commit', '-qm', 'refresh'], { cwd: root }); + expect(await refreshReportLock(root)).toBe('unchanged'); + expect(await readFile(path.join(relative, 'report-lock.patch'), 'utf8')).toBe(patch); + } finally { await rm(root, { recursive: true, force: true }); } +}); diff --git a/tests/runner-e2e/report-lock.json b/tests/runner-e2e/report-lock.json index 4dd5d2bdeff..0872fa1593a 100644 --- a/tests/runner-e2e/report-lock.json +++ b/tests/runner-e2e/report-lock.json @@ -1,6 +1,6 @@ { - "inputSha256": "893496dddc21c31bd812ea106ac30d1515dda305eb1dd183007d89cf5b1bab4d", - "outputSha256": "c7f23021335b60da0cff1dd4c75cf8b948333ef3165d7d1703eb79a589edb798", - "patchSha256": "c7c11e899c12e6a030fe1554a8ceee5f21689a3a4f19956746e852050049cc49", - "basis": "Reviewed corrections to existing patch hashes and the already declared yaml workspace dependency. Existing package tarball integrity entries are unchanged. The only added package is yaml@2.9.1 with its exact integrity pinned by this reviewed correction." + "inputSha256": "c7f23021335b60da0cff1dd4c75cf8b948333ef3165d7d1703eb79a589edb798", + "outputSha256": "a2606a8218799ac96e841d1f3008053df4f4fca24d5db2941ad10b3d62c0e14a", + "patchSha256": "ee382a42cb5738d85068a4cd1ab5ba42db05f6477936d0c0efa65f182ea70f17", + "basis": "Generated with the trusted master lockfile refresh. Review this offline correction and its hashes with the dependency changes." } diff --git a/tests/runner-e2e/report-lock.patch b/tests/runner-e2e/report-lock.patch index 84a0bcac131..9367b5d3ced 100644 --- a/tests/runner-e2e/report-lock.patch +++ b/tests/runner-e2e/report-lock.patch @@ -1,612 +1,53 @@ +diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml +index 7f3361f73c..b074b7f305 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml -@@ -16,7 +16,7 @@ - - patchedDependencies: - '@agentclientprotocol/claude-agent-acp@0.73.0': -- hash: riqgguivxjxydoydnzpedjy5au -+ hash: xjlrz3rllh2ztafbdiywpfh2rq - path: patches/@agentclientprotocol__claude-agent-acp@0.73.0.patch - '@agentclientprotocol/codex-acp@1.6.2': - hash: 2iynuypg76nxmydiylgtffhr7e -@@ -49,7 +49,7 @@ - hash: 55uhvnotpqyiy37rn3pqpukhei - path: patches/embedded-postgres@18.1.0-beta.16.patch - postgres@3.4.9: -- hash: sryle6qd5qfmnxvoebal4gashi -+ hash: 6q4cic6qawywsyeo2spgnjamda - path: patches/postgres@3.4.9.patch - - importers: -@@ -73,7 +73,10 @@ - version: 7.0.2 - vitest: - specifier: ^5.0.3 -- version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)) -+ version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) +@@ -1183,6 +1183,18 @@ importers: + '@base-ui/react': + specifier: ^1.7.0 + version: 1.7.0(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8) ++ '@codemirror/lang-yaml': ++ specifier: ^6.1.3 ++ version: 6.1.3 ++ '@codemirror/language': ++ specifier: ^6.12.4 ++ version: 6.12.4 ++ '@codemirror/state': ++ specifier: ^6.7.2 ++ version: 6.7.6 ++ '@codemirror/view': ++ specifier: ^6.43.11 ++ version: 6.43.11 + '@dnd-kit/core': + specifier: ^6.3.1 + version: 6.3.1(react-dom@19.2.8(react@19.2.8))(react@19.2.8) +@@ -1195,6 +1207,9 @@ importers: + '@lexical/link': + specifier: 0.48.0 + version: 0.48.0(typescript@7.0.2) ++ '@lezer/highlight': ++ specifier: ^1.2.3 ++ version: 1.2.3 + '@mdxeditor/editor': + specifier: ^4.2.3 + version: 4.2.3(@codemirror/language@6.12.4)(@lezer/highlight@1.2.3)(@types/react-dom@19.2.5(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@7.0.2)(yjs@13.6.32) +@@ -1264,6 +1279,9 @@ importers: + cmdk: + specifier: ^1.1.1 + version: 1.1.1(@types/react-dom@19.2.5(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8) ++ codemirror: ++ specifier: ^6.0.2 ++ version: 6.0.2 + i18next: + specifier: ^26.4.2 + version: 26.4.2(typescript@7.0.2) +@@ -1306,6 +1324,9 @@ importers: + tailwind-merge: + specifier: ^3.6.0 + version: 3.6.0 + yaml: + specifier: ^2.8.1 + version: 2.9.1 - - cli: - dependencies: -@@ -133,7 +136,7 @@ - version: 17.4.2 - drizzle-orm: - specifier: 0.45.2 -- version: 0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi)) -+ version: 0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda)) - embedded-postgres: - specifier: ^18.1.0-beta.16 - version: 18.1.0-beta.16(patch_hash=55uhvnotpqyiy37rn3pqpukhei) -@@ -180,7 +183,7 @@ - dependencies: - '@agentclientprotocol/claude-agent-acp': - specifier: ^0.73.0 -- version: 0.73.0(patch_hash=riqgguivxjxydoydnzpedjy5au)(@anthropic-ai/sdk@0.129.0(zod@4.6.5))(@modelcontextprotocol/sdk@1.31.0(zod@4.6.5)) -+ version: 0.73.0(patch_hash=xjlrz3rllh2ztafbdiywpfh2rq)(@anthropic-ai/sdk@0.129.0(zod@4.6.5))(@modelcontextprotocol/sdk@1.31.0(zod@4.6.5)) - '@anthropic-ai/sdk': - specifier: 0.129.0 - version: 0.129.0(zod@4.6.5) -@@ -310,7 +313,7 @@ - version: 7.0.2 - vitest: - specifier: ^5.0.3 -- version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)) -+ version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) - - packages/adapters/hermes-gateway: - dependencies: -@@ -326,7 +329,7 @@ - version: 7.0.2 - vitest: - specifier: ^5.0.3 -- version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)) -+ version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) - - packages/adapters/kimi-local: - dependencies: -@@ -405,13 +408,13 @@ - version: link:../shared - drizzle-orm: - specifier: ^0.45.2 -- version: 0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi)) -+ version: 0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda)) - embedded-postgres: - specifier: ^18.1.0-beta.16 - version: 18.1.0-beta.16(patch_hash=55uhvnotpqyiy37rn3pqpukhei) - postgres: - specifier: ^3.4.9 -- version: 3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi) -+ version: 3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda) - devDependencies: - '@types/node': - specifier: ^24.0.0 -@@ -427,7 +430,7 @@ - version: 7.0.2 - vitest: - specifier: ^5.0.3 -- version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)) -+ version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) - - packages/google-sheets-mcp-server: - dependencies: -@@ -449,7 +452,7 @@ - version: 7.0.2 - vitest: - specifier: ^5.0.3 -- version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)) -+ version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) - - packages/kv-demo-mcp-server: - dependencies: -@@ -468,7 +471,7 @@ - version: 7.0.2 - vitest: - specifier: ^5.0.3 -- version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)) -+ version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) - - packages/mcp-server: - dependencies: -@@ -490,7 +493,7 @@ - version: 7.0.2 - vitest: - specifier: ^5.0.3 -- version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)) -+ version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) - - packages/paperclip-eval-kernel: - devDependencies: -@@ -505,7 +508,7 @@ - dependencies: - '@agentclientprotocol/claude-agent-acp': - specifier: 0.73.0 -- version: 0.73.0(patch_hash=riqgguivxjxydoydnzpedjy5au)(@anthropic-ai/sdk@0.129.0(zod@4.6.5))(@modelcontextprotocol/sdk@1.31.0(zod@4.6.5)) -+ version: 0.73.0(patch_hash=xjlrz3rllh2ztafbdiywpfh2rq)(@anthropic-ai/sdk@0.129.0(zod@4.6.5))(@modelcontextprotocol/sdk@1.31.0(zod@4.6.5)) - '@agentclientprotocol/codex-acp': - specifier: 1.6.2 - version: 1.6.2(patch_hash=2iynuypg76nxmydiylgtffhr7e) -@@ -561,7 +564,7 @@ - version: 19.2.5(@types/react@19.2.18) - '@vitejs/plugin-react': - specifier: ^4.7.0 -- version: 4.7.0(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)) -+ version: 4.7.0(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)(yaml@2.9.1)) - axe-core: - specifier: ^4.12.1 - version: 4.13.0 -@@ -579,10 +582,10 @@ - version: 7.0.2 - vite: - specifier: ^6.1.0 -- version: 6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15) -+ version: 6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)(yaml@2.9.1) - vitest: - specifier: ^5.0.3 -- version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)) -+ version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)(yaml@2.9.1)) - - packages/plugins/create-paperclip-plugin: - dependencies: -@@ -629,7 +632,7 @@ - version: 7.0.2 - vitest: - specifier: ^5.0.3 -- version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)) -+ version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) - - packages/plugins/examples/plugin-file-browser-example: - dependencies: -@@ -747,7 +750,7 @@ - version: 7.0.2 - vitest: - specifier: ^5.0.3 -- version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)) -+ version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) - - packages/plugins/plugin-llm-wiki: - devDependencies: -@@ -786,7 +789,7 @@ - version: 7.0.2 - vitest: - specifier: ^5.0.3 -- version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)) -+ version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) - - packages/plugins/plugin-workspace-diff: - dependencies: -@@ -820,7 +823,7 @@ - version: 7.0.2 - vitest: - specifier: ^5.0.3 -- version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)) -+ version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) - - packages/plugins/sdk: - dependencies: -@@ -880,7 +883,7 @@ - version: 7.0.2 - vitest: - specifier: ^5.0.3 -- version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)) -+ version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) - - packages/teams-catalog: - devDependencies: -@@ -895,7 +898,7 @@ - version: 0.5.0 - '@agentclientprotocol/claude-agent-acp': - specifier: 0.73.0 -- version: 0.73.0(patch_hash=riqgguivxjxydoydnzpedjy5au)(@anthropic-ai/sdk@0.129.0(zod@4.4.3))(@modelcontextprotocol/sdk@1.31.0(zod@4.4.3)) -+ version: 0.73.0(patch_hash=xjlrz3rllh2ztafbdiywpfh2rq)(@anthropic-ai/sdk@0.129.0(zod@4.4.3))(@modelcontextprotocol/sdk@1.31.0(zod@4.4.3)) - '@agentclientprotocol/codex-acp': - specifier: 1.6.2 - version: 1.6.2(patch_hash=2iynuypg76nxmydiylgtffhr7e) -@@ -1006,7 +1009,7 @@ - version: 2.1.0(@grpc/grpc-js@1.14.5)(nice-grpc-common@2.0.4)(nice-grpc@2.1.17) - '@vercel/connect': - specifier: 2.3.3 -- version: 2.3.3(@chat-adapter/slack@4.39.0(patch_hash=226jj24akljccsfbw7bcxujz4u)(ai@7.0.130(zod@4.4.3))(zod@4.4.3))(@modelcontextprotocol/sdk@1.31.0(zod@4.4.3))(ai@7.0.130(zod@4.4.3))(better-auth@1.7.2(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi)))(pg@8.18.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)))) -+ version: 2.3.3(@chat-adapter/slack@4.39.0(patch_hash=226jj24akljccsfbw7bcxujz4u)(ai@7.0.130(zod@4.4.3))(zod@4.4.3))(@modelcontextprotocol/sdk@1.31.0(zod@4.4.3))(ai@7.0.130(zod@4.4.3))(better-auth@1.7.2(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda)))(pg@8.18.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)))) - acorn: - specifier: 8.18.0 - version: 8.18.0 -@@ -1024,7 +1027,7 @@ - version: 3.0.1(ajv@8.20.0) - better-auth: - specifier: 1.7.2 -- version: 1.7.2(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi)))(pg@8.18.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))) -+ version: 1.7.2(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda)))(pg@8.18.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))) - chat: - specifier: 4.39.0 - version: 4.39.0(ai@7.0.130(zod@4.4.3))(zod@4.4.3) -@@ -1045,7 +1048,7 @@ - version: 17.4.2 - drizzle-orm: - specifier: ^0.45.2 -- version: 0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi)) -+ version: 0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda)) - embedded-postgres: - specifier: ^18.1.0-beta.16 - version: 18.1.0-beta.16(patch_hash=55uhvnotpqyiy37rn3pqpukhei) -@@ -1167,10 +1170,10 @@ - version: 7.0.2 - vite: - specifier: ^8.2.2 -- version: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15) -+ version: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1) - vitest: - specifier: ^5.0.3 -- version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)) -+ version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) - - ui: - dependencies: -@@ -1321,10 +1324,10 @@ - version: 10.6.0(@types/react-dom@19.2.5(@types/react@19.2.18))(@types/react@19.2.18)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8)) - '@storybook/react-vite': - specifier: 10.5.10 -- version: 10.5.10(@types/react-dom@19.2.5(@types/react@19.2.18))(@types/react@19.2.18)(esbuild@0.28.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(rollup@4.63.1)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8))(typescript@7.0.2)(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)) -+ version: 10.5.10(@types/react-dom@19.2.5(@types/react@19.2.18))(@types/react@19.2.18)(esbuild@0.28.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(rollup@4.63.1)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8))(typescript@7.0.2)(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) - '@tailwindcss/vite': - specifier: ^4.3.3 -- version: 4.3.3(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)) -+ version: 4.3.3(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) - '@types/node': - specifier: ^24.0.0 - version: 24.13.3 -@@ -1336,7 +1339,7 @@ - version: 19.2.5(@types/react@19.2.18) - '@vitejs/plugin-react': - specifier: ^6.1.1 -- version: 6.1.1(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)) -+ version: 6.1.1(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) - storybook: - specifier: 10.6.0 - version: 10.6.0(@types/react@19.2.18)(react@19.2.8) -@@ -1348,10 +1351,10 @@ - version: 7.0.2 - vite: - specifier: ^8.2.2 -- version: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15) -+ version: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1) - vitest: - specifier: ^5.0.3 -- version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)) -+ version: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) - - packages: - -@@ -9256,6 +9259,11 @@ - yallist@4.0.0: - resolution: {integrity: sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==} - -+ yaml@2.9.1: -+ resolution: {integrity: sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==} -+ engines: {node: '>= 14.6'} -+ hasBin: true -+ - yargs-parser@21.1.1: - resolution: {integrity: sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==} - engines: {node: '>=12'} -@@ -9316,7 +9324,7 @@ - - '@adobe/css-tools@4.5.0': {} - -- '@agentclientprotocol/claude-agent-acp@0.73.0(patch_hash=riqgguivxjxydoydnzpedjy5au)(@anthropic-ai/sdk@0.129.0(zod@4.4.3))(@modelcontextprotocol/sdk@1.31.0(zod@4.4.3))': -+ '@agentclientprotocol/claude-agent-acp@0.73.0(patch_hash=xjlrz3rllh2ztafbdiywpfh2rq)(@anthropic-ai/sdk@0.129.0(zod@4.4.3))(@modelcontextprotocol/sdk@1.31.0(zod@4.4.3))': - dependencies: - '@agentclientprotocol/sdk': 1.4.0(zod@4.4.3) - '@anthropic-ai/claude-agent-sdk': 0.3.286(@anthropic-ai/sdk@0.129.0(zod@4.4.3))(@modelcontextprotocol/sdk@1.31.0(zod@4.4.3))(zod@4.4.3) -@@ -9325,7 +9333,7 @@ - - '@anthropic-ai/sdk' - - '@modelcontextprotocol/sdk' - -- '@agentclientprotocol/claude-agent-acp@0.73.0(patch_hash=riqgguivxjxydoydnzpedjy5au)(@anthropic-ai/sdk@0.129.0(zod@4.6.5))(@modelcontextprotocol/sdk@1.31.0(zod@4.6.5))': -+ '@agentclientprotocol/claude-agent-acp@0.73.0(patch_hash=xjlrz3rllh2ztafbdiywpfh2rq)(@anthropic-ai/sdk@0.129.0(zod@4.6.5))(@modelcontextprotocol/sdk@1.31.0(zod@4.6.5))': - dependencies: - '@agentclientprotocol/sdk': 1.4.0(zod@4.4.3) - '@anthropic-ai/claude-agent-sdk': 0.3.286(@anthropic-ai/sdk@0.129.0(zod@4.6.5))(@modelcontextprotocol/sdk@1.31.0(zod@4.6.5))(zod@4.4.3) -@@ -9907,12 +9915,12 @@ - optionalDependencies: - '@opentelemetry/api': 1.9.1 - -- '@better-auth/drizzle-adapter@1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.10)(kysely@0.29.5)(nanostores@1.5.3))(@better-auth/utils@0.4.2)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi)))': -+ '@better-auth/drizzle-adapter@1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.10)(kysely@0.29.5)(nanostores@1.5.3))(@better-auth/utils@0.4.2)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda)))': - dependencies: - '@better-auth/core': 1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.10)(kysely@0.29.5)(nanostores@1.5.3) - '@better-auth/utils': 0.4.2 - optionalDependencies: -- drizzle-orm: 0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi)) -+ drizzle-orm: 0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda)) - - '@better-auth/kysely-adapter@1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.10)(kysely@0.29.5)(nanostores@1.5.3))(@better-auth/utils@0.4.2)(kysely@0.29.5)': - dependencies: -@@ -10974,11 +10982,11 @@ - '@img/sharp-win32-x64@0.35.4': - optional: true - -- '@joshwooding/vite-plugin-react-docgen-typescript@0.7.0(typescript@7.0.2)(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))': -+ '@joshwooding/vite-plugin-react-docgen-typescript@0.7.0(typescript@7.0.2)(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))': - dependencies: - glob: 13.0.6 - react-docgen-typescript: 2.4.0(typescript@7.0.2) -- vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15) -+ vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1) - optionalDependencies: - typescript: 7.0.2 - -@@ -13184,25 +13192,25 @@ - transitivePeerDependencies: - - '@types/react-dom' - -- '@storybook/builder-vite@10.5.10(esbuild@0.28.2)(rollup@4.63.1)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))': -- dependencies: -- '@storybook/csf-plugin': 10.5.10(esbuild@0.28.2)(rollup@4.63.1)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)) -+ '@storybook/builder-vite@10.5.10(esbuild@0.28.2)(rollup@4.63.1)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))': -+ dependencies: -+ '@storybook/csf-plugin': 10.5.10(esbuild@0.28.2)(rollup@4.63.1)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) - storybook: 10.6.0(@types/react@19.2.18)(react@19.2.8) - ts-dedent: 2.3.0 -- vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15) -+ vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1) - transitivePeerDependencies: - - esbuild - - rollup - - webpack - -- '@storybook/csf-plugin@10.5.10(esbuild@0.28.2)(rollup@4.63.1)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))': -+ '@storybook/csf-plugin@10.5.10(esbuild@0.28.2)(rollup@4.63.1)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))': - dependencies: - storybook: 10.6.0(@types/react@19.2.18)(react@19.2.8) - unplugin: 2.3.11 - optionalDependencies: - esbuild: 0.28.2 - rollup: 4.63.1 -- vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15) -+ vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1) - - '@storybook/global@5.0.0': {} - -@@ -13228,11 +13236,11 @@ - '@types/react': 19.2.18 - '@types/react-dom': 19.2.5(@types/react@19.2.18) - -- '@storybook/react-vite@10.5.10(@types/react-dom@19.2.5(@types/react@19.2.18))(@types/react@19.2.18)(esbuild@0.28.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(rollup@4.63.1)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8))(typescript@7.0.2)(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))': -- dependencies: -- '@joshwooding/vite-plugin-react-docgen-typescript': 0.7.0(typescript@7.0.2)(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)) -+ '@storybook/react-vite@10.5.10(@types/react-dom@19.2.5(@types/react@19.2.18))(@types/react@19.2.18)(esbuild@0.28.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(rollup@4.63.1)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8))(typescript@7.0.2)(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))': -+ dependencies: -+ '@joshwooding/vite-plugin-react-docgen-typescript': 0.7.0(typescript@7.0.2)(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) - '@rollup/pluginutils': 5.4.0(rollup@4.63.1) -- '@storybook/builder-vite': 10.5.10(esbuild@0.28.2)(rollup@4.63.1)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)) -+ '@storybook/builder-vite': 10.5.10(esbuild@0.28.2)(rollup@4.63.1)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) - '@storybook/react': 10.5.10(@types/react-dom@19.2.5(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(storybook@10.6.0(@types/react@19.2.18)(react@19.2.8))(typescript@7.0.2) - empathic: 2.0.1 - magic-string: 0.30.21 -@@ -13242,7 +13250,7 @@ - resolve: 1.22.12 - storybook: 10.6.0(@types/react@19.2.18)(react@19.2.8) - tsconfig-paths: 4.2.0 -- vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15) -+ vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1) - optionalDependencies: - typescript: 7.0.2 - transitivePeerDependencies: -@@ -13335,12 +13343,12 @@ - postcss-selector-parser: 6.0.10 - tailwindcss: 4.3.3 - -- '@tailwindcss/vite@4.3.3(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))': -+ '@tailwindcss/vite@4.3.3(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))': - dependencies: - '@tailwindcss/node': 4.3.3 - '@tailwindcss/oxide': 4.3.3 - tailwindcss: 4.3.3 -- vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15) -+ vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1) - - '@tanstack/query-core@5.102.8': {} - -@@ -13758,14 +13766,14 @@ - dependencies: - execa: 5.1.1 - -- '@vercel/connect@2.3.3(@chat-adapter/slack@4.39.0(patch_hash=226jj24akljccsfbw7bcxujz4u)(ai@7.0.130(zod@4.4.3))(zod@4.4.3))(@modelcontextprotocol/sdk@1.31.0(zod@4.4.3))(ai@7.0.130(zod@4.4.3))(better-auth@1.7.2(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi)))(pg@8.18.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))))': -+ '@vercel/connect@2.3.3(@chat-adapter/slack@4.39.0(patch_hash=226jj24akljccsfbw7bcxujz4u)(ai@7.0.130(zod@4.4.3))(zod@4.4.3))(@modelcontextprotocol/sdk@1.31.0(zod@4.4.3))(ai@7.0.130(zod@4.4.3))(better-auth@1.7.2(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda)))(pg@8.18.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))))': - dependencies: - '@vercel/oidc': 3.8.9 - optionalDependencies: - '@chat-adapter/slack': 4.39.0(patch_hash=226jj24akljccsfbw7bcxujz4u)(ai@7.0.130(zod@4.4.3))(zod@4.4.3) - '@modelcontextprotocol/sdk': 1.31.0(zod@4.4.3) - ai: 7.0.130(zod@4.4.3) -- better-auth: 1.7.2(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi)))(pg@8.18.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))) -+ better-auth: 1.7.2(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda)))(pg@8.18.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))) - - '@vercel/oidc@3.2.0': {} - -@@ -13775,7 +13783,7 @@ - '@vercel/cli-exec': 1.0.1 - jose: 5.10.0 - -- '@vitejs/plugin-react@4.7.0(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15))': -+ '@vitejs/plugin-react@4.7.0(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)(yaml@2.9.1))': - dependencies: - '@babel/core': 7.29.7 - '@babel/plugin-transform-react-jsx-self': 7.29.7(@babel/core@7.29.7) -@@ -13783,14 +13791,14 @@ - '@rolldown/pluginutils': 1.0.0-beta.27 - '@types/babel__core': 7.20.5 - react-refresh: 0.17.0 -- vite: 6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15) -+ vite: 6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)(yaml@2.9.1) - transitivePeerDependencies: - - supports-color - -- '@vitejs/plugin-react@6.1.1(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))': -+ '@vitejs/plugin-react@6.1.1(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))': - dependencies: - '@rolldown/pluginutils': 1.0.1 -- vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15) -+ vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1) - - '@vitest/expect@3.2.4': - dependencies: -@@ -13800,23 +13808,23 @@ - chai: 5.3.3 - tinyrainbow: 2.0.0 - -- '@vitest/mocker@5.0.3(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15))': -+ '@vitest/mocker@5.0.3(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)(yaml@2.9.1))': - dependencies: - '@jridgewell/trace-mapping': 0.3.31 - '@vitest/spy': 5.0.3 - estree-walker: 3.0.3 - magic-string: 1.4.3 - optionalDependencies: -- vite: 6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15) -- -- '@vitest/mocker@5.0.3(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))': -+ vite: 6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)(yaml@2.9.1) -+ -+ '@vitest/mocker@5.0.3(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))': - dependencies: - '@jridgewell/trace-mapping': 0.3.31 - '@vitest/spy': 5.0.3 - estree-walker: 3.0.3 - magic-string: 1.4.3 - optionalDependencies: -- vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15) -+ vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1) - - '@vitest/pretty-format@3.2.4': - dependencies: -@@ -14042,10 +14050,10 @@ - - before-after-hook@4.0.0: {} - -- better-auth@1.7.2(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi)))(pg@8.18.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15))): -+ better-auth@1.7.2(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda)))(pg@8.18.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))): - dependencies: - '@better-auth/core': 1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.10)(kysely@0.29.5)(nanostores@1.5.3) -- '@better-auth/drizzle-adapter': 1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.10)(kysely@0.29.5)(nanostores@1.5.3))(@better-auth/utils@0.4.2)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi))) -+ '@better-auth/drizzle-adapter': 1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.10)(kysely@0.29.5)(nanostores@1.5.3))(@better-auth/utils@0.4.2)(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda))) - '@better-auth/kysely-adapter': 1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.10)(kysely@0.29.5)(nanostores@1.5.3))(@better-auth/utils@0.4.2)(kysely@0.29.5) - '@better-auth/memory-adapter': 1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.10)(kysely@0.29.5)(nanostores@1.5.3))(@better-auth/utils@0.4.2) - '@better-auth/mongo-adapter': 1.7.2(@better-auth/core@1.7.2(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.10)(kysely@0.29.5)(nanostores@1.5.3))(@better-auth/utils@0.4.2) -@@ -14063,11 +14071,11 @@ - zod: 4.4.3 - optionalDependencies: - drizzle-kit: 0.31.10 -- drizzle-orm: 0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi)) -+ drizzle-orm: 0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda)) - pg: 8.18.0 - react: 19.2.8 - react-dom: 19.2.8(react@19.2.8) -- vitest: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)) -+ vitest: 5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) - transitivePeerDependencies: - - '@cloudflare/workers-types' - - '@opentelemetry/api' -@@ -14654,12 +14662,12 @@ - esbuild: 0.25.12 - tsx: 4.23.15 - -- drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi)): -+ drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda)): - optionalDependencies: - '@opentelemetry/api': 1.9.1 - kysely: 0.29.5 - pg: 8.18.0 -- postgres: 3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi) -+ postgres: 3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda) - - dunder-proto@1.0.1: - dependencies: -@@ -16542,7 +16550,7 @@ - dependencies: - xtend: 4.0.2 - -- postgres@3.4.9(patch_hash=sryle6qd5qfmnxvoebal4gashi): {} -+ postgres@3.4.9(patch_hash=6q4cic6qawywsyeo2spgnjamda): {} - - powershell-utils@0.1.0: {} - -@@ -17587,7 +17595,7 @@ - '@types/unist': 3.0.3 - vfile-message: 4.0.3 - -- vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15): -+ vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)(yaml@2.9.1): - dependencies: - esbuild: 0.25.12 - fdir: 6.5.0(picomatch@4.0.7) -@@ -17601,8 +17609,9 @@ - jiti: 2.7.0 - lightningcss: 1.33.0 - tsx: 4.23.15 -- -- vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15): -+ yaml: 2.9.1 -+ -+ vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1): - dependencies: - lightningcss: 1.33.0 - picomatch: 4.0.7 -@@ -17615,11 +17624,12 @@ - fsevents: 2.3.3 - jiti: 2.7.0 - tsx: 4.23.15 -- -- vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)): -+ yaml: 2.9.1 -+ -+ vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)(yaml@2.9.1)): - dependencies: - '@types/chai': 5.2.3 -- '@vitest/mocker': 5.0.3(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)) -+ '@vitest/mocker': 5.0.3(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)(yaml@2.9.1)) - chai: 6.3.0 - es-module-lexer: 2.3.2 - expect-type: 1.4.0 -@@ -17630,7 +17640,7 @@ - tinybench: 6.2.0 - tinyexec: 1.3.1 - tinyglobby: 0.2.17 -- vite: 6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15) -+ vite: 6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.33.0)(tsx@4.23.15)(yaml@2.9.1) - why-is-node-running: 3.2.1 - optionalDependencies: - '@opentelemetry/api': 1.9.1 -@@ -17639,10 +17649,10 @@ - transitivePeerDependencies: - - msw - -- vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)): -+ vitest@5.0.3(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.4.0))(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)): - dependencies: - '@types/chai': 5.2.3 -- '@vitest/mocker': 5.0.3(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)) -+ '@vitest/mocker': 5.0.3(vite@8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) - chai: 6.3.0 - es-module-lexer: 2.3.2 - expect-type: 1.4.0 -@@ -17653,7 +17663,7 @@ - tinybench: 6.2.0 - tinyexec: 1.3.1 - tinyglobby: 0.2.17 -- vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15) -+ vite: 8.2.2(@types/node@24.13.3)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1) - why-is-node-running: 3.2.1 - optionalDependencies: - '@opentelemetry/api': 1.9.1 -@@ -17748,6 +17758,8 @@ - yallist@3.1.1: {} - - yallist@4.0.0: {} -+ -+ yaml@2.9.1: {} - - yargs-parser@21.1.1: {} - + yjs: + specifier: 13.6.32 + version: 13.6.32 diff --git a/tests/runner-e2e/workflow-security.test.ts b/tests/runner-e2e/workflow-security.test.ts index 698f7e71575..d4a577b9f2c 100644 --- a/tests/runner-e2e/workflow-security.test.ts +++ b/tests/runner-e2e/workflow-security.test.ts @@ -95,9 +95,7 @@ describe("public repository paid workflow security", () => { .split(/\n(?= {6}- )/u) .filter((step) => step.includes("uses: pnpm/action-setup@")); - expect(pnpmSetupSteps, workflowName).toHaveLength( - workflowName === "pr-trusted.yml" ? 8 : 7, - ); + expect(pnpmSetupSteps, workflowName).toHaveLength(8); for (const step of pnpmSetupSteps) { expect(step, workflowName).toContain('NPM_CONFIG_AUDIT: "false"'); expect(step, workflowName).toContain('NPM_CONFIG_FUND: "false"'); @@ -141,9 +139,7 @@ describe("public repository paid workflow security", () => { step.includes("uses: pnpm/action-setup@") ? [index] : [], ); - expect(pnpmSetupStepIndexes, name).toHaveLength( - name === "pr-trusted.yml" ? 8 : 7, - ); + expect(pnpmSetupStepIndexes, name).toHaveLength(8); for (const pnpmSetupStepIndex of pnpmSetupStepIndexes) { const pnpmSetupStep = steps[pnpmSetupStepIndex]!; const nodeBootstrapStep = steps[pnpmSetupStepIndex - 1]!; @@ -282,7 +278,9 @@ describe("public repository paid workflow security", () => { expect(authorizeJob.match(/actions\/checkout@/gu)).toHaveLength(1); expect(authorizeJob).toContain("ref: ${{ github.sha }}"); expect(authorizeJob).not.toContain("ref: ${{ needs.authorize.outputs.target_sha }}"); - expect(authorizeJob).not.toContain("pnpm install"); + expect(authorizeJob.match(/run: pnpm install.*$/gmu)).toEqual([ + "run: pnpm install --lockfile-only --frozen-lockfile --ignore-scripts --offline", + ]); expect(targetLockJob).toContain("name: Resolve target pnpm lockfile"); expect(targetLockJob).toContain("needs: authorize"); expect(targetLockJob).toContain(