reference dependencies

Dependencies

The repository is a two-workspace monorepo: an npm workspace for the agent packages (packages/*) and a pnpm workspace for the web stack (web/*). The dependency landscape, the package graph, and the version policy are described below.

Workspace package graph

npm workspace (packages/*)

The root package.json declares npm workspaces over packages/* plus the coding-agent extension examples. All four runtime packages share the lockstep version 0.7.1 and are scoped @earendil-works/* (inherited upstream lineage):

Package	Depends on
packages/ai (@earendil-works/pi-ai)	none of the in-tree packages; the LLM/provider foundation
packages/agent (@earendil-works/pi-agent-core)	@earendil-works/pi-ai, typebox
packages/tui (@earendil-works/pi-tui)	none of the in-tree packages
packages/coding-agent (@earendil-works/pi-coding-agent)	@earendil-works/pi-ai, @earendil-works/pi-agent-core, @earendil-works/pi-tui, and third-party deps

pnpm workspace (web/*)

web/pnpm-workspace.yaml declares the packages app, design, protocol, and server. The web packages depend on @prime-agent/web-protocol via workspace:*. web/server is the only web package that imports the agent packages, and it links them with pnpm link: (not file:) so nested agent deps resolve through the root npm tree:

• @earendil-works/pi-ai → link:../packages/ai
• @earendil-works/pi-agent-core → link:../packages/agent
• @earendil-works/pi-coding-agent → link:../packages/coding-agent
• @earendil-works/pi-tui → link:../packages/tui

web/app depends on @prime-agent/web-design, @prime-agent/web-protocol, and @prime-agent/web-server (all workspace:*). Browser code (web/app/src, web/design) never imports @earendil-works/*; it talks HTTP only.

Do not add packages/{ai,agent,tui,coding-agent} to web/pnpm-workspace.yaml, never npm install inside web/, and never pnpm install at the repo root.

Key third-party dependencies

packages/ai

@anthropic-ai/sdk, openai, @google/genai, @aws-sdk/client-bedrock-runtime, @mistralai/mistralai (provider SDKs), plus typebox (schemas), undici (HTTP), proxy-agent, partial-json (partial stream parsing), zod-to-json-schema, and chalk. ~11 runtime dependencies.

packages/agent

Only @earendil-works/pi-ai and typebox. 2 runtime dependencies.

packages/tui

chalk, marked, mime-types, get-east-asian-width; koffi is an optional dependency for native bindings. 5 runtime dependencies (plus optional).

packages/coding-agent

The largest package. Notable third-party deps and their purpose:

• react / react-dom, use-sync-external-store, component rendering in tools and export templates.
• zeromq, agent connection transport.
• @agentclientprotocol/sdk, the Agent Client Protocol (ACP) surface.
• @silvia-odwyer/photon-node, image processing (photon_rs_bg.wasm).
• proper-lockfile, file locking for settings/auth/session stores.
• diff, minimatch, glob, ignore, hosted-git-info, yaml, tooling for edits, git packages, and config.
• marked, cli-highlight, strip-ansi, markdown and terminal rendering.
• debug, undici, extract-zip, file-type, jiti, uuid, typebox, chalk.

~27 runtime dependencies plus the optional @mariozechner/clipboard.

web/protocol

@openuidev/lang-core, @asteasolutions/zod-to-openapi, zod. 3 runtime dependencies.

web/server

zod plus the three linked @earendil-works/* packages and @prime-agent/web-protocol. 5 runtime dependencies (3 are in-tree links).

web/design

The component library. Notable deps: react, @base-ui/react, cmdk, lucide-react, @tabler/icons-react, motion, recharts, sonner, shadcn, class-variance-authority, clsx, tailwind-merge, tw-animate-css, next-themes, react-error-boundary, lottie-react, @openuidev/react-lang, and the code/markdown renderers @pierre/diffs, @streamdown/code, streamdown. ~24 runtime dependencies.

web/app

react, @tanstack/react-router / @tanstack/react-start / @tanstack/react-query, tailwindcss with @tailwindcss/vite, zod, plus the three @prime-agent/web-* workspace packages. 11 runtime dependencies.

Version policy

Both ecosystems enforce a 7-day minimum release age on new dependency versions:

• Root .npmrc sets min-release-age=7 (enforced by npm >= 11.10; older npm silently ignores it).
• web/pnpm-workspace.yaml sets minimumReleaseAge: 10080 (7 days in minutes) to match.

Bypass only for an urgent security patch: npm install --min-release-age=0 <pkg>.

web/pnpm-workspace.yaml also carries a unification override: shiki: 4.4.2. This reconciles the highlighter types across packages where @streamdown/code pins shiki 3.x while @pierre/diffs pins 4.x, so both resolve to a single shiki version.

The root package.json adds overrides for rimraf (pinned to 6.1.2, including via gaxios) and shell-quote. Never remove or downgrade code to fix a type error from an outdated dependency; upgrade the dependency instead. See Patterns and conventions for the full dependency and release rules.