build: migrate from aube to pnpm by ThomasK33 · Pull Request #176 · coder/agent-tty

ThomasK33 · 2026-09-24T10:15:18Z

Why

Dependabot cannot update aube-lock.yaml. Its PRs (for example #173) change only package.json, and then every CI job fails at aube ci because the lockfile is out of date. This PR moves the repo from aube to pnpm, so dependency bots work again and contributors use one standard package manager.

What changed

Lockfile. aube-lock.yaml → pnpm-lock.yaml. aube already writes pnpm's lockfile v9 format, so I copied main's file and ran pnpm install. No resolved version changed: each of the 314 packages in main's aube lock is in the pnpm lock at the same version. The 62 new entries are platform variants of optional native bindings (esbuild, oxlint, oxfmt, rolldown, lightningcss) and the wasm fallback's deps (@emnapi/*, @napi-rs/wasm-runtime, @tybys/wasm-util). supportedArchitectures still limits which ones get installed.
package.json. packageManager: pnpm@10.34.5. The top-level overrides moved to pnpm.overrides (the same 11 pins as main). pnpm.allowBuilds became pnpm.onlyBuiltDependencies (the same 6 packages).
pnpm-workspace.yaml. Keeps supportedArchitectures and trustPolicyExclude. Adds minimumReleaseAge: 1440 and trustPolicy: no-downgrade, so we keep the supply-chain checks that aube ran by default.
mise. "npm:pnpm" = "10.34.5" replaces aube. npm.package_manager = "npm" makes mise install it with npm. Tasks: bootstrap = pnpm install && pnpm exec playwright install chromium, bootstrap-ci = pnpm install --frozen-lockfile, audit = pnpm audit --audit-level high. In mise.lock, the aube block became an npm:pnpm entry. I edited it by hand, because mise lock deletes the task-level ffmpeg conda entries.
Workflows. ci.yml (edited by hand): the jobs that list their mise tools (lifecycle-model, checks-macos, test-integration-macos) install npm:pnpm in place of aube. The other jobs install every tool with --locked. release.yml has a comment fix only.
New .github/dependabot.yml for npm (pnpm) and github-actions, weekly, with a 7-day cooldown. 7 days is zizmor's minimum, and it is longer than minimumReleaseAge.
verify-agent-tty skill. start-run.sh runs pnpm install --frozen-lockfile. The old script ran aube ci when node_modules/.bin/tsc was missing. pnpm's frozen install repairs a missing node_modules/.bin by itself (I deleted .bin and the install restored it), so one command covers both cases.
Docs. AGENTS.md, docs/CONTRIBUTING.md, docs/INSTALL.md, ADR 0009, .mux/init and the verify-agent-tty SKILL.md. I left CHANGELOG.md and the archived plans/ as they are, because they record history.

Design choices

pnpm 10, not 11 or 12. GitHub's Dependabot docs list pnpm v7 to v10 as supported. pnpm v11 support was closed as done only on 2026-09-15 (dependabot-core#14794), and follow-up bugs are still open.
npm build of pnpm, not the standalone binary. node-pty 1.1.0 has no Linux prebuilds, so its install script runs node-gyp rebuild. The npm build of pnpm bundles node-gyp. mise's standalone aqua:pnpm/pnpm binary does not, so the install fails with node-gyp: not found.

Validation

Local runs on a shared host with load average 40 to 90:

Clean frozen install: rm -rf node_modules && mise run bootstrap-ci passed, and node-pty compiled.
mise run --force of format-check, workflow-lint, lint, audit (0 high or critical, 6 moderate), typecheck, build, test-unit, install-smoke and validate-bundles: all exit 0.
test-integration: 406 passed, 2 failed. test-e2e: 33 passed, 2 failed. All four are timing limits: list under 2000 ms in non-reaping-init.test.ts, a 5 s Chromium boot in backend-selection.test.ts, the color-grid idle wait in export-fixtures.test.ts, and the 30 s hello-prompt flow. A side-by-side run of those four files with --retry=0 on a main worktree installed with aube ci failed the same tests on this host (main: 8 of 19 failed, this branch: 9 of 19). This PR changes no file under src/. CI on GitHub runners is the gate for these.
start-run.sh dependency step: with node_modules/.bin deleted, pnpm install --frozen-lockfile restored node_modules/.bin/tsc (exit 0).

Risks

Release pipeline not run. release.yml, release-please.yml and npm publish run only on tags or dispatch. They use the same mise run bootstrap-ci and mise run ci paths tested here, and publishing still uses npm publish <tarball>.
The mise.lock entry for npm:pnpm pins the version with no checksum. The mise npm backend records no checksum. The aqua backend does, but it cannot build node-pty.
Dependabot is untested until it runs on main. Security updates skip the cooldown, so a fix published less than a day earlier can hit minimumReleaseAge. minimumReleaseAgeExclude is the escape hatch. pnpm.* settings in package.json work in pnpm 10. pnpm 11+ ignores them, so they must move to pnpm-workspace.yaml when we upgrade.
Harmless npm warn Unknown env config lines during install. pnpm exports npm_config_* variables, and prepare calls npm run build, which warns about them.

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

Dependabot cannot update aube-lock.yaml, so its PRs change only package.json and fail every CI job at `aube ci`. Switch to pnpm 10 (the newest line Dependabot documents as supported). - pnpm-lock.yaml: converted from aube-lock.yaml (same lockfile v9 format) with zero resolved-version drift; pnpm additionally records every platform variant of optional native bindings. - package.json: packageManager pnpm@10.34.5; overrides move to pnpm.overrides; allowBuilds becomes pnpm.onlyBuiltDependencies. - pnpm-workspace.yaml: keep aube's default supply-chain guards (minimumReleaseAge 1440, trustPolicy no-downgrade). - mise: install pnpm from npm (bundles node-gyp, which node-pty needs on Linux); tasks use pnpm install --frozen-lockfile and pnpm audit. - Add .github/dependabot.yml for npm and github-actions. - Update CI macOS tool list, docs, AGENTS.md, and .mux/init. --- _Generated with [`xum`](https://github.com/coder/xum) • Model: `anthropic:claude-opus-5-5` • Thinking: `high`_

# Conflicts: # .github/workflows/ci.yml # package.json # pnpm-lock.yaml

ThomasK33 · 2026-11-05T18:14:58Z

@codex review

ThomasK33 · 2026-11-05T18:15:05Z

@codex security review

chatgpt-codex-connector · 2026-11-05T18:16:40Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-05T20:26:00.215344Z	`d2e248f`	Manual request
🔒 Security Review	✅ Completed 2026-11-05T20:26:54.261110Z	`d2e248f`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector · 2026-11-05T18:20:42Z

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 0a9ba974a7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-11-05T18:24:37Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 0a9ba974a7

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

ThomasK33 · 2026-11-05T19:54:33Z

@codex review

ThomasK33 · 2026-11-05T19:54:40Z

@codex security review

chatgpt-codex-connector · 2026-11-05T19:58:26Z

Codex Review: Didn't find any major issues. 👍

Reviewed commit: e37672f638

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-11-05T20:01:44Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: e37672f638

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

ThomasK33 · 2026-11-05T20:12:50Z

@codex review

ThomasK33 · 2026-11-05T20:12:57Z

@codex security review

chatgpt-codex-connector · 2026-11-05T20:15:44Z

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 53549a06a4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-11-05T20:17:35Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 53549a06a4

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

ThomasK33 · 2026-11-05T20:22:03Z

@codex review

ThomasK33 · 2026-11-05T20:22:10Z

@codex security review

chatgpt-codex-connector · 2026-11-05T20:25:58Z

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: d2e248f86c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-11-05T20:26:52Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: d2e248f86c

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

ThomasK33 · 2026-11-05T20:52:29Z

Review record for the merge decision.

Final commit: d2e248f (origin/main merged in at 24ed1ef).
CI on the final commit: every check passed, including quality-gates, quality-gates-macos and pr-title.
Codex: 4 rounds, one per head (0a9ba97, e37672f, 53549a0, d2e248f). Each round's normal and security reviews found no issues. There are no unresolved threads.
Independent verifiers: PASS on 0a9ba97. ISSUES on e37672f (the pnpm 11 wording was wrong, fixed in 53549a0). PASS on 53549a0 with one wording nit (fixed in d2e248f). PASS on d2e248f.
Clean-context advisor: REDUCE SCOPE, meaning drop .github/dependabot.yml because weekly version updates go beyond the package-manager switch. I kept the file: it has been part of this PR since c4da89a, and the PR exists to make Dependabot work.
Reason for stopping: every gate is clean on the final commit.

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

ThomasK33 mentioned this pull request Sep 24, 2026

build(nix): add reproducible package and dev shell #167

Closed

Merge remote-tracking branch 'origin/main' into pnpm-migration

0a9ba97

# Conflicts: # .github/workflows/ci.yml # package.json # pnpm-lock.yaml

ThomasK33 marked this pull request as ready for review November 5, 2026 18:14

docs: say the pnpm fallback setup needs pnpm 10

e37672f

docs: state only what the pnpm 10 fallback setup needs

53549a0

docs: end the pnpm 10 warning before the setup commands

d2e248f

ThomasK33 added this pull request to the merge queue Nov 5, 2026

Merged via the queue into main with commit 1002a3f Nov 5, 2026
27 checks passed

ThomasK33 deleted the chore/pnpm-migration branch November 5, 2026 21:08

github-actions Bot mentioned this pull request Nov 5, 2026

chore(release): 0.6.0 #172

Open

Conversation

ThomasK33 commented Sep 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What changed

Design choices

Validation

Risks

Uh oh!

ThomasK33 commented Nov 5, 2026

Uh oh!

ThomasK33 commented Nov 5, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot commented Nov 5, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 5, 2026

🛡️ Codex Security Review

Uh oh!

ThomasK33 commented Nov 5, 2026

Uh oh!

ThomasK33 commented Nov 5, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 5, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 5, 2026

🛡️ Codex Security Review

Uh oh!

ThomasK33 commented Nov 5, 2026

Uh oh!

ThomasK33 commented Nov 5, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 5, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 5, 2026

🛡️ Codex Security Review

Uh oh!

ThomasK33 commented Nov 5, 2026

Uh oh!

ThomasK33 commented Nov 5, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 5, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 5, 2026

🛡️ Codex Security Review

Uh oh!

ThomasK33 commented Nov 5, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

ThomasK33 commented Sep 24, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Nov 5, 2026 •

edited

Loading