mirror of
https://github.com/CopilotKit/CopilotKit.git
synced 2026-09-14 16:26:20 +08:00
Benjamin Taylor
1110f18e30
The packed Channels umbrella (and the runtime-package verify) install first-party packages straight from the registry, so a just-published @copilotkit/* version fails pnpm's 24h minimumReleaseAge check — this is what reddened `unit (20.x)` on channels PRs. The enumerated exclude lists drift every time an internal dependency is added (main already had to bolt on @copilotkit/channels-core, then #6012 added @copilotkit/core + shared). Wildcard the @copilotkit/* scope (org-owned, same publish pipeline — no outsider can inject a package, and it stops the drift). Keep @ag-ui enumerated rather than wildcarded: it's a separate upstream org, so we don't extend immediate-install trust to its entire scope. Third-party deps stay fully gated. Applied to both the generated consumer workspace and the repo-root .npmrc. Verified: `pnpm run verify:channels-umbrella` installs the packed umbrella with no ERR_PNPM_NO_MATURE_MATCHING_VERSION; umbrella unit tests green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>