pnpm-workspace.yaml

packages:
  - apps/*
  - services/*
  - services/cloud-agent-next/wrapper
  - services/gastown/container
  - services/kiloclaw/controller
  - services/kiloclaw/plugins/*
  - packages/*

catalog:
  '@cloudflare/vitest-pool-workers': 0.16.13
  # The OAuth 2.1 provider the kilo-mcp worker delegates its hand-rolled
  # authorization/token server to. Pinned exactly; adopted with the KV binding
  # and zod schemas in the same change.
  '@cloudflare/workers-oauth-provider': 0.10.3
  '@cloudflare/workers-types': 4.20260605.1
  # Workers-compatible JSON Schema validator for the kilo-mcp call tool.
  # AJV cannot run on Workerd: it compiles schemas with `new Function`, which
  # the Workers runtime forbids. Pinned exactly.
  '@cfworker/json-schema': 4.1.1
  '@octokit/auth-app': 8.2.0
  # Only for packages that shell out to the `sentry-cli` binary directly (Workers,
  # mobile). Must NOT be added to `overrides`: the Sentry bundler plugins consume
  # @sentry/cli through its Node API, which v3 broke. See the note in `overrides`.
  '@sentry/cli': 3.8.0
  '@tanstack/query-async-storage-persister': 5.104.3
  '@tanstack/react-query': 5.104.3
  '@tanstack/react-query-persist-client': 5.104.3
  '@trpc/client': 11.19.0
  '@trpc/server': 11.19.0
  '@trpc/tanstack-react-query': 11.19.0
  '@types/jsonwebtoken': 9.0.10
  '@types/node': 24.12.4
  '@typescript/native-preview': 7.0.0-dev.20260707.2
  '@vitest/coverage-v8': 4.1.12
  '@vitest/ui': 4.1.12
  '@workos-inc/node': 11.0.0
  aws4fetch: 1.0.20
  drizzle-kit: 0.31.11
  drizzle-orm: 0.45.2
  hono: 4.13.13
  jose: 6.2.12
  jsonwebtoken: 9.0.3
  p-limit: 7.3.0
  stripe: 23.0.0
  tsx: 4.23.15
  # TypeScript 7 is the native compiler and ships no compiler JS API. The
  # workspace typechecks with the @typescript/native-preview `tsgo` binary, so
  # this entry is what `tsc`, `next build` and the bundlers load. The one tool
  # that still reads the API (rollup-plugin-dts) gets a compatibility package of
  # its own instead of a second pin here.
  typescript: 7.0.2
  ulid: 3.0.2
  vitest: 4.1.12
  workers-tagged-logger: 1.0.0
  wrangler: 4.135.0
  zod: 4.6.7

catalogs:
  # Active test stack: vitest 5 plus its companions at the same version.
  # Workspaces still on the default `catalog:` entries above at vitest 4 are the
  # ones that test through `@cloudflare/vitest-pool-workers` (it peers only
  # `^4.1.0`, so vitest 5 breaks its pool) and the excluded features.
  vitest5:
    '@vitest/coverage-v8': 5.0.5
    '@vitest/ui': 5.0.5
    vitest: 5.0.5

minimumReleaseAge: 6842
minimumReleaseAgeExclude:
  - tsx
  - '@cloudflare/sandbox@0.12.12'
  # Cloudflare's DO-managed container runtime (ctx.container, snapshotContainer).
  # wrangler 4.134.0 is the first release with local development support for
  # DO-managed Containers (named-image selection via ctx.container.images).
  # 4.135.0 exact-pins its own workerd/miniflare runtime, so those exact versions
  # are exempted with it. Approved early-access exception; remove all eight entries
  # when 4.135.0 matures (workerd 2026-09-18, wrangler 2026-09-18).
  - wrangler@4.135.0
  - workerd@1.20260918.1
  - miniflare@5.20260918.0-alpha
  - '@cloudflare/workerd-darwin-64@1.20260918.1'
  - '@cloudflare/workerd-darwin-arm64@1.20260918.1'
  - '@cloudflare/workerd-linux-64@1.20260918.1'
  - '@cloudflare/workerd-linux-arm64@1.20260918.1'
  - '@cloudflare/workerd-windows-64@1.20260918.1'
  - expo-dev-client
  - expo-dev-launcher
  - expo-dev-menu
  - expo-dev-menu-interface
  - expo-manifests
  - expo-updates-interface
  - '@expo/schema-utils'
  - '@typescript/native-preview'
  - '@typescript/native-preview-darwin-arm64'
  - '@typescript/native-preview-darwin-x64'
  - '@typescript/native-preview-linux-arm'
  - '@typescript/native-preview-linux-arm64'
  - '@typescript/native-preview-linux-x64'
  - '@typescript/native-preview-win32-arm64'
  - '@typescript/native-preview-win32-x64'
  # Anthropic adds new parameters regularly and we can't really wait for them to stabilize
  - '@ai-sdk/anthropic'
  - '@anthropic-ai/sdk'
  # Kilo SDK releases are owned internally and adopted with pinned runtime validation.
  - '@kilocode/sdk'
  # KiloClaw pins and live-smoke-validates OpenClaw image upgrades before rollout.
  - openclaw
  # FlashList 2.3.3 fixes the scroll window in EngagedIndicesTracker: the window
  # was computed from the projected offset alone, so when the trailing buffer was
  # smaller than the projection delta, rows actually on screen were excluded. The
  # agent transcript list is exactly that shape. Patch release; exempted so the
  # contract test's pin can move off 2.3.2 without waiting out minimumReleaseAge.
  - '@shopify/flash-list@2.3.3'
  # react-native-reanimated 4.7.1 carries the stability fixes the app needs
  # (synchronously updated props reset, Android crashes, layout animations).
  # Approved early exception; worklets 0.13.0 is its required pair and is old
  # enough on its own.
  - react-native-reanimated@4.7.1
  # @types/bun is DefinitelyTyped only: types, no runtime code, no install scripts.
  # The wrapper and gastown dev types must equal the Bun the sandbox runs, which
  # sandbox-image-versions.test.ts asserts. Bun 1.4.4 is the first release that
  # rejects the compromised eMudhra chains, so the pair moves before the window.
  - '@types/bun@1.4.4'
  - bun-types@1.4.4
overrides:
  # One pg client in the tree: drizzle-orm's optional peers include pg, so two
  # pg versions split drizzle-orm into two packages and their SQL types stop
  # being assignable to each other across workspace imports.
  pg: 8.23.1
  # Do NOT add an '@sentry/cli' override here to dedupe it against the catalog.
  # @sentry/react-native pulls @sentry/bundler-plugins@10, which requires
  # @sentry/cli ^2.58.5 and calls it through its Node API. v3 replaced the
  # CommonJS default class export with a named one, so forcing v3 makes every
  # `new SentryCli()` throw "_sentry_cli.default is not a constructor". The plugin
  # swallows that as a recoverable error, so builds stay green while silently
  # uploading nothing. This previously broke apps/web source maps for months.
  # @sentry/nextjs 11 no longer consumes @sentry/cli (its bundler plugin uses the
  # separate `sentry` CLI package), so the web path no longer relies on this rule;
  # the mobile path still does.
  '@babel/plugin-transform-modules-systemjs': 7.29.7
  '@babel/core': 7.29.7
  mdast-util-to-hast: 13.2.1
  storybook: 10.6.2
  next: 16.4.2
  preact: 10.28.4
  adm-zip: 0.6.1
  baseline-browser-mapping: 2.11.20
  browserslist: 4.28.7
  # An entry added or changed here names a reviewed version: an exact pin for the
  # version the lockfile carries, or a range that also states its upper bound, so
  # the entry moves only through a reviewed change to this file and the lockfile.
  # esbuild below keeps a floor without an upper bound; see its own note.
  glob: 13.0.6
  google-auth-library: 10.6.2
  # Two 0.28.x copies are in the tree as peer variants of the vite/vitest/storybook
  # graph, so a bound here re-points those dependents. Not narrowed in this change.
  esbuild: '>=0.28.1'
  lodash: 4.18.1
  diff: 8.0.3
  fast-xml-parser: 5.7.3
  fflate@^0.4.8: 0.4.9
  fflate@^0.8.2: 0.8.3
  vite: '>=8.1.6 <8.2.0'
  form-data: 4.0.6
  follow-redirects: 1.16.1
  ws@^7: 7.5.11
  ws@^8: 8.21.0
  tmp: 0.2.7
  dompurify: 3.4.17
  handlebars: 4.7.10
  brace-expansion: 5.0.12
  node-forge: 1.4.0
  proxy-addr: 2.0.8
  compression: 1.8.2
  source-map-js: 1.2.2
  tinypool: 2.1.2
  postcss: 8.5.30
  # @modelcontextprotocol/sdk declares zod as a peer and packages/harness-sdk
  # relies on the auto-installed peer. Without this line, a dependency that
  # brings a newer zod into the dev graph (knip) would silently change the zod
  # the shipped MCP client is built against. Follow the catalog pin so the two
  # cannot drift apart.
  '@modelcontextprotocol/sdk>zod': 'catalog:'
  picomatch@^2: 2.3.2
  picomatch@^4: 4.0.4
  yaml: 2.8.4
  undici@^7: 7.30.1
  path-to-regexp: 8.4.2
  ip-address: 10.7.1
  image-size@^1: npm:image-size-next@1.2.2
  image-size@^2: npm:image-size-next@2.1.1
  drizzle-orm: 0.45.2
  lodash-es: 4.18.1
  '@xmldom/xmldom': 0.8.15
  qs: 6.16.1
  smol-toml: 1.9.0
  uuid@<11.1.1: 11.1.1
  # Nothing in the tree depends on serialize-javascript today; the spec stays for a
  # future dependent, bounded to the reviewed major.
  serialize-javascript: '>=7.0.3 <8'
  hono: 4.13.13
  '@modelcontextprotocol/sdk@1.29.0': 1.32.1
  '@modelcontextprotocol/sdk@1.32.1>@hono/node-server': 2.0.10
  # @simplewebauthn/server's ASN.1 parser must come from the same
  # @peculiar/asn1-schema copy its asn1-ecc/asn1-rsa decorators register their
  # schemas into. apps/web pins asn1-schema/-x509 to 2.8.0 for its Apple App
  # Attest code, and pnpm deduped the WebAuthn library's ^2.6.0 range onto that
  # copy while asn1-ecc resolved 2.9.4, so `AsnParser.parse(DER, ECDSASigValue)`
  # threw "Cannot get schema for 'ECDSASigValue' target" and every ES256
  # assertion was refused. Scope the newer copy to this dependency only.
  '@simplewebauthn/server>@peculiar/asn1-schema': 2.9.4
  '@simplewebauthn/server>@peculiar/asn1-x509': 2.9.4
  undici@^6: 6.29.1
  undici@^8: 8.12.2
  # The root vercel CLI pins undici 5.28.4 through @vercel/node. The 5.x line has
  # no release for the advisories fixed in 6.24.0-6.28.1, so it moves to the
  # same 6.x copy as above, which also drops its @fastify/busboy dependency.
  undici@^5: 6.29.1
  # Further vercel CLI transitives with exact vulnerable pins: @vercel/fun,
  # @vercel/python-analysis and @vercel/backends respectively. eas-cli likewise
  # pins vulnerable minimatch 5, nanoid 3 and ajv 8 (ajv also via
  # @vercel/static-config).
  '@tootallnate/once@^2': 2.0.1
  minimatch@^5: 5.1.9
  nanoid@^3: 3.3.20
  ajv@^8: 8.20.0
  minimatch@^10: 10.2.6
  '@vercel/backends>srvx': 0.11.22
  # zod 4 below 4.6.6 grows issue lists without bound on oversized arrays.
  # Exact pins in @kilocode/plugin and the vercel CLI follow the catalog instead.
  'zod@>=4.0.0 <4.6.6': 'catalog:'
  # 1.30.2+ regresses var() round-trip through JS visitors, breaking
  # react-native-css's metro transformer. Upstream issue:
  # https://github.com/parcel-bundler/lightningcss/issues/1081
  lightningcss: 1.30.1
  axios: 1.20.0
  fast-uri: 3.1.8
  joi: 17.13.8
  postcss-selector-parser@^7.0.0: 7.1.6
  postcss-selector-parser@6.0.10: 7.1.6
  webpack-dev-middleware@^6: 7.4.6
  toml: 5.0.1
  '@opentelemetry/core': 2.8.0
  body-parser: 2.4.0
  js-yaml: 4.3.2
  linkify-it: 5.0.2
  protobufjs: 7.6.5
  sharp: 0.35.5
  tar: 7.5.21
  pbkdf2: 3.1.7
  shell-quote: 1.11.0
  # Keep one @slack/web-api in the tree. @chat-adapter/slack needs ^7.18.0 while
  # @slack/socket-mode still asks for ^7.15.0, so without this we end up with two
  # copies of the WebClient. apps/web also depends on it directly and constructs
  # its own WebClient, so the versions must agree. 7.x is the ceiling until
  # @chat-adapter/slack moves to @slack/web-api 8.
  '@slack/web-api': 7.19.0
  # Keep the app, widgets peer and router on one native-module copy.
  '@expo/ui': 58.0.17
packageExtensions:
  # Undeclared upstream deps that break config evaluation outside the Expo CLI
  # under pnpm's isolated linker (autoInstallPeers is false). An injected
  # dependency selects a version at install, so each one is pinned to the copy its
  # package already resolves.
  '@sentry/react-native':
    dependencies:
      '@expo/config-plugins': 58.0.9
      # React Native does not expose Metro to Sentry's vendored require calls.
      # Pin the exact Metro used by the SDK 58 @expo/metro graph.
      metro: 0.87.1
  expo-share-intent:
    dependencies:
      '@expo/plist': 0.10.1
  react-native-appsflyer:
    dependencies:
      # This package's own Expo SDK line resolves 57.x; pin that copy, not the
      # 58.x one the other injection uses.
      '@expo/config-plugins': 57.0.9
  # Native ref declarations must use the app's React type identity.
  react-native-screens:
    peerDependencies:
      '@types/react': '*'
  '@rn-primitives/slot':
    peerDependencies:
      '@types/react': '*'
  react-native-reanimated:
    peerDependencies:
      '@types/react': '*'
patchedDependencies:
  # Text date styles for the glanceable widgets and Live Activity: `elapsed`
  # ("31 minutes", no seconds) and `ago` ("3 minutes ago"). Also separates a
  # bottom sheet's drag gesture from its back/scrim dismissal and lets a caller
  # veto a requested dismissal, so a scrolling form can keep its values.
  # Android closes through native hide before unmounting. Keep src/ and build/
  # bottom-sheet implementations aligned: the default export resolves to build/.
  # The dialog key listener covers Back before Compose's lifecycle handler starts.
  '@expo/ui@58.0.17': patches/@expo+ui@58.0.17.patch
  expo-dev-launcher@58.0.14: patches/expo-dev-launcher@58.0.14.patch
  # The app owns the layout direction: the picker forces RTL for an RTL language
  # and relaunches, and the unset build-time template value must not reset that
  # choice before React renders, or the relaunched app comes back in the other
  # direction on every launch. Android links the package's published AAR unless
  # apps/mobile/package.json lists expo-localization under
  # expo.autolinking.android.buildFromSource, so this patch only takes effect
  # there while that entry stays.
  expo-localization@58.0.4: patches/expo-localization@58.0.4.patch
  # A zero badge count must not cancel every app notification: upstream called
  # cancelAll(), which removed the ongoing Active Agents card on Android.
  expo-notifications@58.1.4: patches/expo-notifications@58.1.4.patch
  # Repo-local features the SDK lacks, carried onto each SDK patch release:
  # router — rank static-suffix siblings before catch-all index routes, and
  # keep the bottom tab bar from becoming one accessibility element (iOS named
  # it after the first tab and treated it as the container of every screen);
  # widgets — Live Activity state query (getInfo), areLiveActivitiesEnabled,
  # includeEnded instance reads, factory-registered push-to-start URL.
  expo-router@58.0.19: patches/expo-router@58.0.19.patch
  # Typed-routes generation must skip colocated tests, exactly like the Metro
  # blockList in apps/mobile/metro.config.js already does for the runtime
  # bundle. A `*.test.tsx` next to a route registers as a route, and a
  # `_layout.*.test.tsx` (src/app/(app)/(tabs)) registers as that group's
  # layout; the generator then drops the group's entire subtree, so every
  # `(tabs)` route vanishes from the generated `Href` union and typecheck
  # rejects valid navigations.
  '@expo/router-server@58.0.13': patches/@expo+router-server@58.0.13.patch
  # workerd has no undici ALPN support and the bundle must not read package.json
  # at runtime: use globalThis.fetch and inline the SDK version the push request
  # headers report. The patch hard-codes 6.1.0, so it is pinned to that release
  # instead of widening to every later one.
  expo-server-sdk@6.1.0: patches/expo-server-sdk@6.1.0.patch
  # Android: keep the React host after a headless expo-task-manager run. The
  # loader destroyed the host after each background task, and a destroyed host
  # keeps its native memory, so each background push or refresh added a new
  # instance until a native allocation aborted the process (KILO-APP-3EF).
  expo-modules-core@58.0.18: patches/expo-modules-core@58.0.18.patch
  # Null-guard the headless app loader in TaskService.executeTask. Without it a
  # data-only FCM wake during cold start dereferences a null loader and fatally
  # crashes the app (KILO-APP-9V; expo/expo#41663, expo/expo#46449).
  expo-task-manager@58.0.11: patches/expo-task-manager@58.0.11.patch
  expo-widgets@58.0.17: patches/expo-widgets@58.0.17.patch
  # PurchaseConnector.create returns the native promise, so a create failure
  # is observable. Android: compile against the project's Kotlin stdlib, not
  # the 2.4.10 default that RN 0.86's Kotlin 2.1 compiler cannot read. The
  # package ships TypeScript source, so its `typeof jest` guard (TS2708 here)
  # gets a ts-ignore.
  react-native-appsflyer@7.0.2-v2: patches/react-native-appsflyer@7.0.2-v2.patch
  # Android accessibility: the virtual per-paragraph nodes that EnrichedMarkdownText
  # publishes to TalkBack took their bounds from `getPrimaryHorizontal(start)` and
  # `getPrimaryHorizontal(end)`, which run right-to-left in a right-to-left paragraph,
  # so the pair collapsed to a zero-width rect and the node was unreachable. Bound the
  # ordered offsets, and the painted line when they still coincide.
  # Android: a hugged markdown node re-measures its height at the width its view
  # actually receives, so a line that the display view wraps is inside the box.
  react-native-enriched-markdown@1.1.1: patches/react-native-enriched-markdown@1.1.1.patch
  # Fabric mounting race: RCTComponentViewFactory registers component views from
  # the JS thread without the class-map mutex, so a mounting transaction can
  # dereference an unregistered handle and crash (EXC_BAD_ACCESS 0x18,
  # KILO-APP-6H; react/react-native#58299). Also synchronizes the
  # LegacyViewManagerInterop cache. iOS needs buildReactNativeFromSource to
  # compile this in — see apps/mobile/app.config.ts.
  react-native@0.88.0: patches/react-native@0.88.0.patch
  # Android: read the live entry of the unique work chain, not the first one.
  # A finished first entry made a cold start re-enqueue with REPLACE, which
  # cancelled the glanceable refresh run in progress.
  expo-background-task@58.0.10: patches/expo-background-task@58.0.10.patch
  # Android: defer sheet insets registration to ON_RESUME when React has no
  # current activity during fragment ON_START; react-native-screens#4531.
  react-native-screens@4.30.0: patches/react-native-screens@4.30.0.patch
  # React Native installs on-device JSI bindings through its TurboModule runtime hook.
  llama.rn@0.12.9: patches/llama.rn@0.12.9.patch
  stripe@23.0.0: patches/stripe@23.0.0.patch
  '@expo/react-native-action-sheet@4.1.1': patches/@expo+react-native-action-sheet@4.1.1.patch
  # Keep lease renewal errors categorical; neither runtime may log receipt handles.
  '@vercel/queue@0.8.0': patches/@vercel+queue@0.8.0.patch
  # Give the Apple @ExpoModule class scan 60 s instead of the hard-coded 5 s.
  # Slow macOS CI runners exceed 5 s; the configure phase then leaves modules
  # out of the modules provider and the iOS build fails. Keep src/ and build/
  # aligned: the build/ copy is the one autolinking runs.
  expo-modules-autolinking@58.0.13: patches/expo-modules-autolinking@58.0.13.patch
publicHoistPattern:
  - '@types/*'
  - '*import-in-the-middle*'
  - '*require-in-the-middle*'
  - metro
autoInstallPeers: false
allowBuilds:
  # Verifies the resolved native binding, and only when it is absent installs the
  # matching @swc/wasm through npm. Never fetches a bare binary.
  '@swc/core': true
  # No install hook in the versions the lockfile resolves; the native binary is an
  # optional platform package. Kept so a future release that adds a build step stays
  # gated behind this list.
  '@tailwindcss/oxide': true
  # Uses the @esbuild/<platform> optional dependency, and otherwise downloads the
  # binary from the registry and checks it against `esbuild.binaryHashes`.
  esbuild: true
  # Compiles the PostgreSQL client binding with node-gyp against the system libpq.
  libpq: true
  # Uses the @cloudflare/workerd-<platform> optional dependency; when it is missing,
  # downloads that platform package from the registry.
  workerd: true
  # Downloads its prebuilt iOS xcframework and Android JNI libraries from the
  # matching GitHub release and verifies each archive's SHA-256 (Quick Chat GGUF).
  llama.rn: true
  # Downloads the vendored tree-sitter grammar sources and the iOS math xcframework
  # from their upstream releases; a missing manifest is a no-op.
  react-native-enriched-markdown: true
  '@sentry/cli': false
  bufferutil: false
  core-js: false
  core-js-pure: false
  es5-ext: false
  msgpackr-extract: false
  oxc-resolver: false
  protobufjs: false
  sharp: false
  unrs-resolver: false
  utf-8-validate: false
  '@google/genai': false
  koffi: false
  openclaw: false
  '@openrouter/sdk': false
  spawn-sync: false
  tree-sitter-bash: false
  # WebDriver binary for the extension's Firefox e2e suite; the postinstall
  # downloads the driver for the current platform from its GitHub release.
  geckodriver: true
  dtrace-provider: false
  '@scarf/scarf': false
  '@parcel/watcher': false