deepseek-harness/pnpm-workspace.yaml

packages:
  - vendor/*
  - packages/*/*
  # Product assemblies over the packages tier (the structure introduced with
  # the dsh CLI): apps/cli is the `dsh` bin.
  - apps/*
  - website
  # The runnable demo leaves join as ONE workspace member: examples/package.json
  # declares the union of every leaf's cordis.yml plugins as workspace:*, so a
  # plain-node (`:lib`) boot of any leaf (examples/<leaf>/cordis.yml) resolves its
  # plugins through real package `exports`→lib by walking up to examples/node_modules.
  # Members for DEPENDENCY RESOLUTION only — NOT build targets: tsdown's explicit
  # globs (vendor/*, packages/*/*) exclude them. See the example-execute-over-tsx Agent Note.
  - examples
  # Deploy root of the single-exe build: a pure dependency manifest whose
  # closure is what the exe bundles and what the Python runtime distributes.
  - python/sdk-runtime

peerDependencyRules:
  allowedVersions:
    typescript: '>=5 <7'

# pnpm 10+ blocks any dependency shipping an install/build script until it is
# explicitly reviewed here (strictDepBuilds defaults to true: an unlisted script
# is a hard install error). Every such package MUST be listed; we deny by
# default and only allow scripts we need. esbuild (native binary) and lefthook
# (git hooks) genuinely need theirs.
allowBuilds:
  esbuild: true
  lefthook: true
  # Cross-platform PTY boundary for the TUI process smoke, including ConPTY on Windows.
  node-pty: true
  # Pulled in by @earendil-works/pi-ai (optional LLM API backend). pnpm lists
  # them only because they ship lifecycle scripts, but those are no-ops we don't
  # need, so we deny them — install still succeeds.
  '@google/genai': false
  protobufjs: false
  node-addon-require-builtin: false
  # JSONL durability calls MoveFileExW with write-through publication on Windows.
  koffi: true

# The Landlock launcher family is our own sibling-repo release, consumed
# fresh (hours old at each coordinated bump) — the release-age quarantine
# would block every such bump, so the family is exempted BY NAME, not by
# pinned version.
minimumReleaseAgeExclude:
  - node-addon-landlock-run
  - node-addon-landlock-run-linux-arm64
  - node-addon-landlock-run-linux-x64
  # Cordis release candidates are source-vendored and pinned in vendor/README.md
  # during the same-day sync that updates package manifests and the lockfile.
  - '@cordisjs/plugin-loader@1.0.0-rc.5'
  - cordis@4.0.0-rc.7