lintianle
2cde2a9032
Conflict resolution notes: - package.json/run-gates: both sides' new doc-sync gates kept (master's scoped-events/readme gates + this branch's website-api/website-yaml); js-yaml devDeps deduped (master added them independently). - pnpm-workspace/knip: website AND python/sdk-runtime entries kept. - doc-typecheck/verify-type-equiv: master's condensed headers kept, website glob retained in both scan scopes. - vendor/cordis/src/fiber.ts: master's lifecycle-hardening code taken; this branch's richer FiberState JSDoc reapplied on top. vendor/README.md logs both local modifications (hardening = 6, JSDoc enrichment = 7). - pnpm-lock: regenerated from master's side (pnpm install). Post-merge sync the gates forced (the system working as designed): - verify-website-yaml caught 4 stale plugin names from master's package reorg (dsh-stdio-agent -> dsh-stdio-demo, dsh-acp-agent -> dsh-acp-demo); 8 references fixed across guide/ and develop/. - gen-website-api picked up master's 6 new services automatically (ctx.approval/permission/sandbox/sessionQuery/skills/tasks -> 6 new pages + sidebar); api/index.md hub updated to list them. - AGENTS.md budget ceiling 1370 -> 1400: the website rows (layout line + two command lines) and master's own growth collided with the old ceiling; all three website rows are load-bearing (new top-level dir, new CI command).
40 lines
1.5 KiB
YAML
40 lines
1.5 KiB
YAML
packages:
|
|
- vendor/*
|
|
- packages/*/*
|
|
- website
|
|
# Deploy root of the single-exe build: a pure dependency manifest whose
|
|
# closure is what the exe bundles and what the Python runtime distributes.
|
|
- python/sdk-runtime
|
|
|
|
peerDependencyRules:
|
|
allowedVersions:
|
|
typescript: '>=5 <7'
|
|
|
|
# pnpm 10+ blocks any dependency shipping an install/build script until it is
|
|
# explicitly reviewed here (strictDepBuilds defaults to true: an unlisted script
|
|
# is a hard install error). Every such package MUST be listed; we deny by
|
|
# default and only allow scripts we need. esbuild (native binary) and lefthook
|
|
# (git hooks) genuinely need theirs.
|
|
allowBuilds:
|
|
esbuild: true
|
|
lefthook: true
|
|
# Pulled in by @earendil-works/pi-ai (optional LLM API backend). pnpm lists
|
|
# them only because they ship lifecycle scripts, but those are no-ops we don't
|
|
# need, so we deny them — install still succeeds.
|
|
'@google/genai': false
|
|
protobufjs: false
|
|
node-addon-require-builtin: false
|
|
|
|
# The Landlock launcher family is our own sibling-repo release, consumed
|
|
# fresh (hours old at each coordinated bump) — the release-age quarantine
|
|
# would block every such bump, so the family is exempted BY NAME, not by
|
|
# pinned version.
|
|
minimumReleaseAgeExclude:
|
|
- node-addon-landlock-run
|
|
- node-addon-landlock-run-linux-arm64
|
|
- node-addon-landlock-run-linux-x64
|
|
# Cordis release candidates are source-vendored and pinned in vendor/README.md
|
|
# during the same-day sync that updates package manifests and the lockfile.
|
|
- '@cordisjs/plugin-loader@1.0.0-rc.5'
|
|
- cordis@4.0.0-rc.7
|