Skip to content

chore: pnpm — the fleet has one package manager - #478

Merged
github-actions[bot] merged 2 commits into
mainfrom
chore/pnpm
Sep 4, 2026
Merged

chore: pnpm — the fleet has one package manager#478
github-actions[bot] merged 2 commits into
mainfrom
chore/pnpm

Conversation

@catomean

@catomean catomean commented Sep 4, 2026

Copy link
Copy Markdown
Collaborator

Converts fleetcrown to pnpm 11.25.0 (Wave 7 Phase B, batch 3a — last of the four).

  • packageManager: pnpm@11.25.0; lockfile generated via pnpm import, package-lock.json removed
  • npm workspaces replaced by pnpm-workspace.yaml packages (packages/agent), and bridge/ joins the workspace — one install and one lockfile cover root + bridge, so its separate package-lock.json and deploy.yml's npm --prefix bridge ci step are gone
  • npm overrides (fast-uri pin) moved to pnpm-workspace.yaml — pnpm silently ignores the npm-only field
  • allowBuilds: better-sqlite3, node-pty, @sentry/cli, native toolchain, plus the two git-hosted deps (@fleet/ai-forms, limitkit — pnpm requires the exact resolved spec for git deps; the keys move if the pinned tags move); temporary minimumReleaseAgeExclude for our own @bitbaum/ai-kit@0.6.2 (published <24h ago, inside pnpm 11's release-age window)
  • Phantom deps fixed: @auth/core (src/auth.ts augments @auth/core/jwt — TS2664 under pnpm's strict layout), dotenv, sharp (scripts)
  • CI/audit/deploy workflows: pnpm/action-setup@v6, store-dir pinned outside the action's bin dir, cache: pnpm, frozen-lockfile installs; Next cache key hashes pnpm-lock.yaml; npm auditpnpm audit
  • desktop-release: the root install becomes pnpm; desktop/ itself stays an npm package (own lockfile, electron/node-gyp toolchain untouched)
  • Husky: the pre-push staleness gate now compares pnpm-lock.yaml against node_modules/.modules.yaml; hooks and ops scripts (deploy-hetzner, hetzner/deploy, install-app, doctor, smoke) converted
  • check-deploy-ready fleet gate now also recognizes pnpm run verify/pnpm test CI lines
  • scripts/control-states.generated.sh: the committed output was stale relative to its generator (missing recently_active); the build regenerated it

Verified locally: lint (0 errors), tsc --noEmit, test:unit (130/130 files), production build (widget + standalone assembly). verify/test:ops deliberately left to CI.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WqKqMnHQHSmkGFfc5t7Rxn

catomean and others added 2 commits September 4, 2026 11:59
- packageManager pnpm@11.25.0; lockfile via pnpm import, package-lock.json
  removed; npm "workspaces" replaced by pnpm-workspace.yaml packages
  (packages/agent), and bridge/ joins the workspace — one install, one
  lockfile, its own package-lock.json removed
- npm "overrides" (fast-uri pin) moved to pnpm-workspace.yaml (pnpm ignores
  the npm-only field)
- allowBuilds: better-sqlite3, node-pty, @sentry/cli, native toolchain, and
  the two git-hosted deps (@fleet/ai-forms, limitkit — pnpm wants the exact
  resolved spec, keys move with the pinned tags); temporary
  minimumReleaseAgeExclude for our own @bitbaum/ai-kit@0.6.2
- phantom deps declared: @auth/core (src/auth.ts augments @auth/core/jwt —
  TS2664 under pnpm's strict layout), dotenv, sharp (scripts)
- CI/audit/deploy workflows: pnpm/action-setup@v6, store-dir pinned outside
  the action's bin dir, cache: pnpm, frozen-lockfile; deploy's separate
  `npm --prefix bridge ci` is covered by the workspace install; Next cache
  key hashes pnpm-lock.yaml; npm audit → pnpm audit
- desktop-release: root install → pnpm; desktop/ itself STAYS an npm package
  (own package-lock.json, electron toolchain untouched)
- husky: pre-push staleness gate now compares pnpm-lock.yaml against
  node_modules/.modules.yaml; hooks + scripts (deploy-hetzner, hetzner/deploy,
  install-app, doctor, smoke) converted to pnpm
- check-deploy-ready fleet gate now recognizes pnpm verify/test lines too

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WqKqMnHQHSmkGFfc5t7Rxn
@github-actions
github-actions Bot merged commit 65dea6f into main Sep 4, 2026
3 checks passed
@github-actions
github-actions Bot deleted the chore/pnpm branch September 4, 2026 10:35
github-actions Bot pushed a commit that referenced this pull request Sep 4, 2026
…off by 2x (#480)

Three follow-ups from sweeping the earlier findings. Two of the four I had
carried forward did NOT survive checking and are dropped: /api/control/dispatch
is a real route, so the docs referencing it are correct; and
scripts/test/push-notifications.ts exists. Verifying first is why this commit
is smaller than the list that prompted it.

1. THE TEST NOBODY RAN, FOR A REASON THAT WAS NEVER TRUE

scripts/test/push-notifications.ts read scripts/agent-hook-bridge.sh, which was
deleted on 2026-06-11 in 956ccf6 ("delete the bash daemon and bridge files").
It threw ENOENT and the suite exited 1. Its entry in test-unit.ts SKIP said
"needs push/web-push env — run manually". That was never the reason: every
check in the file is a static file read and it needs no environment at all.

A wrong skip reason is worse than no skip. It answers the question that would
have found the bug, so the red looked accounted for and nobody looked again for
three months.

Retargeted rather than deleted. The behaviour moved instead of going away — a
closing run reaches the operator through notify-close.ts → pushToUser →
push-fanout — and scripts/test/notify-close.ts covers that module without
mentioning push at all. So "an agent finished, tell the operator" was asserted
by nobody. Deleting the check would have quietly ratified that hole.

Removed from SKIP, so it now runs in test:unit (132/132) and therefore in CI.
Mutation-proven: renaming the pushToUser call fails with "notify-close must
call pushToUser" (exit 1); restored, exit 0.

2. THE BOX IS HALF THE MACHINE THE DOCS DESCRIBE

Measured 2026-09-04: nproc 4, 7746 MiB, 75 G disk, 4 GB swap. That is a CX33.
Three docs said CX43, 8 vCPU / 16 GB, 40 GB disk — every figure but the swap
wrong, in the direction that matters: planning against 16 GB on an 8 GB box is
how you meet the OOM killer.

src/app/api/system/hetzner/route.ts has said "the box is a cx33" all along, so
this was code and docs disagreeing with the code being right. Note the shape of
the drift: CPU and RAM went DOWN while disk went UP (40→75), which is what a
disk-inclusive rescale to a smaller tier looks like — plausibly to escape the
disk-full problem the old caveat describes. The June runbook entry is kept as
history and marked superseded rather than rewritten.

The docs now point at /api/system/hetzner instead of restating numbers. A
hardcoded spec is a second source of truth that rots silently, which is exactly
what happened here between June and September.

3. THE COMPOSER STATUS, FINISHED

#479 gave this line its own row below `sm` but kept `sm:truncate`, which left it
at 57% on a 1440 viewport — "Autopilot on: queue is empty, so FleetCr…". That is
the same defect as the phone's 14%, just less obvious, and there is no `title`
here so the remainder is unreachable at every width. It now wraps everywhere.
Costs one toolbar line when the sentence is long; truncating cost the half of
the sentence that says what will happen.

pnpm run verify passes (repo moved to pnpm in #478).


Claude-Session: https://claude.ai/code/session_01UvjGNAS9CMfEGNW26tUR4P

Co-authored-by: Mao Nakamoto <41178744+maonakamoto@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant