chore(effect): bump published provider/sandbox pins to 0.4.11/0.4.14

[ThomasK33]

Summary

Update the published packages consumed by the private Effect spike:

Dependency	Before	After
@coder/ai-sdk-provider	0.4.9	0.4.11
@coder/ai-sdk-sandbox	0.4.12	0.4.14

Exactly four files change: packages/effect/package.json, its README's Pinned surface table, the matching exact minimumReleaseAgeExclude entries in pnpm-workspace.yaml, and pnpm-lock.yaml.

Provider coupling and lockfile

The Effect spike intentionally consumes published @coder packages rather than workspace links. Its direct @ai-sdk/provider exact pin stays at 4.0.10, matching the dependency inside published @coder/ai-sdk-provider@0.4.11 (verified with npm metadata), to preserve the same LanguageModelV4 type surface. The lockfile resolves a single @ai-sdk/provider@4.0.10.

pnpm dedupe --check passed clean after install: no stale, collapsible provider subtree and no dedupe rewrite needed. @ai-sdk/mcp is unchanged at 2.0.45, as is its age-gate entry. No unrelated dependencies, pnpm/packageManager/toolchain pins, lockfile format, or release-please changelogs changed.

Validation

Using pinned Node 26.8.1 and pnpm 11.25.0 through mise exec --:

• pnpm install
• pnpm dedupe --check
• pnpm format and pnpm check (format, lint, typecheck)
• pnpm -r build
• pnpm -r test — 597 passed; 7 live tests skipped without credentials
• pnpm publint
• pnpm attw
• Lockfile invariants: single provider 4.0.10; MCP unchanged at 2.0.45; pnpm and lockfile format unchanged

Live e2e: 7/7 passed against https://dogfood.cdr.dev on 2026-09-06 at 19:35 UTC, on current head 7f0d4ecc8ffed3f4f18188d14467258a839a90bb; temporary token revoked afterward. Screenshot and accelerated terminal recording are attached in the validation comment. The earlier blocked attempt targeted the retired dev.coder.com endpoint; the maintainer supplied the current endpoint. CI Required and both Codex review loops are clean on this same head, with zero unresolved threads.

Verification tier: source/manifests, published npm metadata, local automated validation, and verified live against dogfood.cdr.dev.

---

Generated with mux • Model: coder:openai/gpt-6-astra • Thinking: high

[ThomasK33]

@codex review

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-06T15:47:05.914359Z	7f0d4ec	Manual request
🔒 Security Review	✅ Completed 2026-09-06T15:48:43.148533Z	7f0d4ec	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: 7f0d4ecc8f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 7f0d4ecc8f

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[ThomasK33]

Live E2E: 7/7 passed

Validated current head 7f0d4ecc8ffed3f4f18188d14467258a839a90bb against https://dogfood.cdr.dev on 2026-09-06, 19:34:44–19:35:15 UTC:

cd packages/agent
mise exec -- npx vitest run test/e2e

Result: 1 test file passed, 7 tests passed (7), zero skipped, 28.43s. The temporary effect-pins-e2e token was revoked afterward. Unfiltered test diagnostics were retained locally; attached terminal evidence shows the run (video replay accelerated).

Correction to the earlier blocker: dev.coder.com is retired, not the current dogfood endpoint. The maintainer supplied the replacement dogfood.cdr.dev; its health and authentication were verified before this run. No repository changes or review reset were needed.

Verification tier: verified live against dogfood.cdr.dev. CI Required and both Codex loops are clean on the same head, with zero unresolved review threads.

---

Generated with mux • Model: coder:openai/gpt-6-astra • Thinking: high

live-e2e.webm