mirror of
https://github.com/CopilotKit/CopilotKit.git
synced 2026-09-14 16:26:20 +08:00
Lukas Moschitz
1559be1ff1
`showcase/harness` is a pnpm workspace member (pnpm-workspace.yaml), so its
only install path is pnpm from the root `pnpm-lock.yaml`. Both consumers run
exactly that: `showcase/harness/Dockerfile` (`pnpm install --frozen-lockfile
--filter @copilotkit/showcase-harness...`) and the `harness unit suite` job
in `test_unit-showcase.yml`. Nothing anywhere ran `npm ci` in this directory
— no Dockerfile, workflow, or script referenced the lockfile.
Because no gate ever read it, it rotted unobserved. Against a fresh
regeneration it was 106 package versions stale, carried 51 packages no longer
required, and was missing `axe-core` outright — which is how it surfaced:
`npm ci` here failed with "Missing: axe-core@4.11.1 from lock file" for
anyone who saw the file and reasonably concluded this package installs with
npm.
Regenerating it was the wrong fix. npm resolves a materially different tree
than the one CI and prod actually run — 9 direct deps diverged, with
`@hono/node-server` off by a whole major (pnpm 2.0.0 vs npm 1.19.17) — and
npm cannot see the root `pnpm.overrides` block, 73 minimum-version floors
with several security patches among them, because that field is pnpm-only.
A working `npm ci` here would hand a developer a green install against
versions that never ship, and could silently resolve below an intended
security floor. The stale file was a signpost pointing the wrong way, so it
is removed rather than maintained.
The root `pnpm-lock.yaml` already resolves `axe-core` at 4.11.1 correctly;
verified that `pnpm install --frozen-lockfile --ignore-scripts` succeeds and
that axe-core 4.11.1 is present in the harness tree with no npm lockfile,
and that the harness typechecks clean once the gitignored showcase fixtures
are generated the way CI generates them.
Adds a NOTE in pnpm-workspace.yaml recording why no npm lockfile belongs
here, so the file is not re-added in good faith as it was in 671cc6ae1d.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
52 lines
2.6 KiB
YAML
52 lines
2.6 KiB
YAML
packages:
|
|
- "packages/*"
|
|
- "examples/v1/*"
|
|
- "examples/v2/*"
|
|
- "examples/v2/*/apps/*"
|
|
- "examples/v2/react/*"
|
|
- "examples/v2/vue/*"
|
|
- "examples/v2/angular/*"
|
|
- "examples/v2/react-native/*"
|
|
- "examples/v2/runtime/*"
|
|
- "examples/showcases/generative-ui-playground"
|
|
# NOTE: `examples/showcases/reskinnable-demo` is intentionally NOT part of
|
|
# this pnpm workspace, for the same reason as `showcase/shell-dashboard`
|
|
# below: it ships its own lockfile and installs its `@copilotkit/*` and
|
|
# `@ag-ui/*` dependencies from npm rather than from `workspace:*`.
|
|
#
|
|
# It has to. Its agent is a Python deep agent whose subagents are only
|
|
# representable over AG-UI on the canary line
|
|
# (`@ag-ui/* 0.0.59-canary.1786716392.0` + `@copilotkit/* 1.62.2-canary…`) —
|
|
# the released `@ag-ui/client` 0.0.57 rejects `SUBAGENT_*` events in the HTTP
|
|
# transport before any middleware runs and kills the whole stream. Pinning
|
|
# those canaries as ROOT overrides would impose an unreleased protocol on
|
|
# every package in the monorepo for one app's benefit; keeping the demo out of
|
|
# the workspace confines them to the app that needs them.
|
|
#
|
|
# ⚠ KNOWN GAP, tracked as a follow-up: Nx discovers projects THROUGH the pnpm
|
|
# workspace (there is no `workspaceLayout` in `nx.json`), so removing the demo
|
|
# here also removes it from the repo-wide `nx run-many -t build`
|
|
# (`static_compat.yml`) and `-t check-types` (`static_quality.yml`) sweeps —
|
|
# verified: `nx show project deep-agents` and the other standalone showcases
|
|
# return "Could not find project". No workflow names this demo, so it is
|
|
# currently unbuilt and untype-checked in CI. It needs its own workflow job
|
|
# (`pnpm install && pnpm build && pnpm typecheck` in its directory), which is
|
|
# NOT in this change. Run the four gates locally until that lands.
|
|
- "examples/slack"
|
|
- "examples/teams"
|
|
- "!examples/v1/_legacy"
|
|
- "showcase/scripts"
|
|
# No npm lockfile here: installs with pnpm from the root pnpm-lock.yaml.
|
|
- "showcase/harness"
|
|
- "showcase/eval-webhook"
|
|
- "showcase/angular"
|
|
# NOTE: `showcase/shell-dashboard` is intentionally NOT part of this
|
|
# pnpm workspace. It's a flat, standalone Next.js app that ships its
|
|
# own package-lock.json and is built with `npm ci` (see its Dockerfile).
|
|
# Including it here would force it into the pnpm lockfile, which
|
|
# breaks its independent deploy path and invalidates the npm-based
|
|
# Docker build. `showcase/scripts` IS in the workspace because the
|
|
# harness package imports from it and both use pnpm.
|
|
onlyBuiltDependencies:
|
|
- better-sqlite3
|