fix(scripts): declare minimatch at the repo root so the marker check runs in a fresh worktree

[anandgupta42]

Issue for this PR

Closes #1176

Type of change

• Bug fix

What does this PR do?

Declares minimatch in the root devDependencies.

script/upstream/analyze.ts imports minimatch (three call sites), but the script lives at the repo root, so it resolves against the root node_modules. The package was only declared in packages/opencode/package.json. In a fresh worktree the marker check therefore fails with Cannot find package 'minimatch' before it can evaluate anything — which is confusing, because the failure has nothing to do with the changes being checked.

One line, no behavior change.

How did you verify your code works?

Reproduced and fixed in a clean worktree created off main:

• Before: bun install then bun run script/upstream/analyze.ts --markers --base main --strict → Cannot find package 'minimatch'.
• After: same sequence → ok All custom code in upstream-shared files is properly marked.

Screenshots / recordings

N/A

Checklist

• Verified in a clean worktree
• No behavior change to shipped code

---

Note

Low Risk
Dev-only dependency wiring for a root script; no changes to application or release artifacts.

Overview
Adds minimatch (10.0.3) to the root devDependencies (and lockfile) so script/upstream/analyze.ts can resolve it when run from the repository root.

That script dynamically imports minimatch for glob-style keepOurs / skipFiles matching during upstream marker checks. The dependency lived only under packages/opencode, so a fresh worktree after bun install could fail with Cannot find package 'minimatch' before any marker logic ran. No runtime or shipped-product behavior changes—only dependency placement for root-level tooling.

^{Reviewed by Cursor Bugbot for commit d559efb. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Declares minimatch at the repo root and commits the matching bun.lock entry so the upstream analyze marker check runs in a fresh worktree.

• script/upstream/analyze.ts imports minimatch but lives at the repo root, so a fresh checkout previously failed with Cannot find package 'minimatch' before the check could run, since the package was only declared in packages/opencode.
• Committing the lockfile entry keeps bun install --frozen-lockfile from rejecting a fresh install and a plain bun install from leaving a dirty tree. Closes Marker check fails in a fresh worktree: minimatch not declared at the repo root #1176.

^{Written for commit d559efb. Summary will update on new commits.}

Summary by CodeRabbit

• Chores
  • Added the minimatch development dependency.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-29T17:06:34.387350Z	5547071	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• bun.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1e5f7204-45a9-4d02-b4bc-09ee775927d2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bac9e77d-82ee-4c2d-8a03-a3f138eedb86

📥 Commits

Reviewing files that changed from the base of the PR and between 23e5903 and 5547071.

📒 Files selected for processing (1)

• package.json

Included review availability: Your plan provides up to 4 included reviews per hour; 2 remain after this review.

---

📝 Walkthrough

Walkthrough

The root package.json adds minimatch version 10.0.3 to devDependencies.

Changes

Development dependency update

Layer / File(s)	Summary
Add minimatch development dependency package.json	Adds minimatch version 10.0.3 to the root devDependencies block.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 55470

Adding the root development dependency lets the marker check run in fresh worktrees without changing shipped behavior; no actionable merge-blocking risk remains after normal checks.

Poem

A rabbit checks the package row
minimatch joins the tools below
Version ten point zero point three
Now hops into development neatly
One small change, clear as can be

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the root cause and the main fix: declaring minimatch at the repository root so the marker check works in a fresh worktree.
Description check	✅ Passed	The description follows the template. It includes the issue, change type, cause, fix rationale, verification steps and results, screenshots status, and checklist information.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/root-minimatch-dep

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5547071803

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• bun.lock
• package.json

Previous Review Summary (commit 5547071)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 5547071)

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
package.json	106	Root bun.lock was not regenerated for the new minimatch devDependency, leaving the lockfile out of sync

Files Reviewed (1 file)

• package.json - 1 issue

Fix these issues in Kilo Cloud

---

_{Reviewed by deepseek-v4-pro · Input: 33.9K · Output: 5.2K · Cached: 246.3K}

_{Review guidance: REVIEW.md from base branch main}

[anandgupta42]

Review disposition

Two reviewers raised the same single finding.

#	Finding	Raised by	Disposition
1	bun.lock was not regenerated, so the manifest and the committed lockfile disagree — bun install --frozen-lockfile would reject a fresh install, and a plain bun install would leave a dirty tree	Codex, Kilo Code	Fixed — d559efbfda

minimatch@10.0.3 was already resolved in the lockfile's package section as a transitive dependency of glob, so the change is the one missing root-workspace devDependencies line and nothing else:

@@ -18,6 +18,7 @@
          "husky": "9.1.7",
 +        "minimatch": "10.0.3",
          "oxlint": "1.60.0",

On devDependencies vs dependencies

devDependencies is correct. The only consumer is script/upstream/analyze.ts, a repo-root maintenance script invoked as bun run script/upstream/analyze.ts by contributors and CI. It is not reachable from any published package: the root manifest is private, script/ is not part of any package's published files, and no runtime module under packages/*/src imports minimatch. Nothing that ships to users resolves it.

Verification

• bun install --frozen-lockfile --dry-run — passes (it failed before this commit, which is the reported symptom).
• bun run script/upstream/analyze.ts --markers --base main --strict — clean, and it now runs in a fresh worktree, which is the change this PR exists to make.
• bun run typecheck — clean, 13/13 packages.