Tianyi Cui
ce484c0e2d
@google/genai and protobufjs are pulled in transitively by the dsh-llm-pi-ai adapter and consumed prebuilt; their lifecycle scripts are no-ops we don't need. Set them to false in allowBuilds (was true) so no unnecessary install-time code runs, and document why each entry is the way it is.
25 lines
1003 B
YAML
25 lines
1003 B
YAML
packages:
|
|
- vendor/*
|
|
- packages/*
|
|
|
|
peerDependencyRules:
|
|
allowedVersions:
|
|
typescript: '>=5 <7'
|
|
|
|
# pnpm 10+ blocks any dependency shipping an install/build script until it is
|
|
# explicitly reviewed here (strictDepBuilds defaults to true: an unlisted script
|
|
# is a hard install error). Every such package MUST be listed; we deny by
|
|
# default and only allow scripts we need. esbuild (native binary) and lefthook
|
|
# (git hooks) genuinely need theirs.
|
|
allowBuilds:
|
|
esbuild: true
|
|
lefthook: true
|
|
# Transitive deps of @earendil-works/pi-ai (the dsh-llm-pi-ai design-twin
|
|
# adapter, ADR 0010), consumed prebuilt — surprising to see here, but pnpm
|
|
# lists them only because they ship lifecycle scripts. Those scripts are
|
|
# no-ops we don't need (@google/genai's preinstall is an `echo`; protobufjs's
|
|
# postinstall only warns about version schemes and returns early when unset),
|
|
# so we deny them: install still succeeds, no needless code runs.
|
|
'@google/genai': false
|
|
protobufjs: false
|