pnpm - SFW

.ebextensions/runtime-bundle.config

@@ -0,0 +1,11 @@
+container_commands:
+  01_restore_runtime_package_json:
+    command: |
+      if [ -f package.json.seize-real ]; then
+        mv package.json.seize-real package.json
+      fi
+  02_verify_runtime_bundle:
+    command: |
+      test -f server.js
+      test -d node_modules
+      test -f .next/BUILD_ID

.gitattributes

@@ -0,0 +1 @@
+bin/*.cmd text eol=crlf

.github/workflows/build-upload-deploy-prod.yml

@@ -25,21 +25,35 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Install Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: "22"
 
-      - name: Install dependencies
-        run: npm ci
+      - name: Activate pinned pnpm
+        run: |
+          corepack enable pnpm
+          corepack prepare "$(node -p 'require("./package.json").packageManager')" --activate
+          pnpm --version
 
-      - name: Verify registry signatures
-        run: npm audit signatures
+      - name: Install Socket Firewall
+        id: socket_firewall
+        uses: SocketDev/action@2d3f25590c6ed6ba11a9a14c064d962a3a04698f # v1.3.1
+        with:
+          mode: firewall
+
+      - name: Assert npm lockfile is absent
+        run: ./bin/6529 guard:no-package-lock
+
+      - name: Install dependencies
+        env:
+          SFW_BIN: ${{ steps.socket_firewall.outputs.firewall-path-binary }}
+        run: ./bin/6529 install:frozen
 
       - name: Lint package.json versions
-        run: npm run lint:package-json
+        run: ./bin/6529 lint:package-json
 
       - name: Build App
         env:
@@ -58,14 +72,49 @@ jobs:
           ASSETS_FROM_S3: ${{ env.ASSETS_FROM_S3 }}
           SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
           SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-        run: npm run build
+        run: ./bin/6529 run build
 
       - name: Build Target
         run: |
-          mkdir -p target/_next
+          rm -rf target .deploy-bundle
+          mkdir -p target/_next .deploy-bundle/.next
+
+          test -f .next/standalone/server.js
+          cp -r .next/standalone/. .deploy-bundle/
           cp -r .next/static target/_next/
-          zip -r package.zip . -x '*.git*' 'node_modules/*' 'target/*'
-          mv package.zip target/
+          cp -r .next/static .deploy-bundle/.next/
+          cp -r public .deploy-bundle/
+          cp Procfile .deploy-bundle/
+          cp -r .ebextensions .deploy-bundle/
+          if [ -d .platform ]; then
+            cp -r .platform .deploy-bundle/
+          fi
+
+          # Next standalone includes a dangling pnpm symlink for semver that
+          # Elastic Beanstalk trips over during StageApplication ownership fixes.
+          rm -f .deploy-bundle/node_modules/.pnpm/node_modules/semver
+
+          for file in BUILD_ID PUBLIC_RUNTIME.json ASSETS_FROM_S3; do
+            if [ -f ".next/$file" ]; then
+              cp ".next/$file" ".deploy-bundle/.next/$file"
+            fi
+          done
+
+          (
+            cd .deploy-bundle
+            zip -yr ../target/package.zip .
+          )
+
+      - name: Verify package bundle size
+        run: |
+          PACKAGE_SIZE_BYTES=$(stat -c%s target/package.zip)
+          PACKAGE_SIZE_MB=$((PACKAGE_SIZE_BYTES / 1024 / 1024))
+          MAX_SIZE_BYTES=$((500 * 1024 * 1024))
+          echo "package.zip size: ${PACKAGE_SIZE_MB} MB (${PACKAGE_SIZE_BYTES} bytes)"
+          if [ "$PACKAGE_SIZE_BYTES" -gt "$MAX_SIZE_BYTES" ]; then
+            echo "Elastic Beanstalk source bundle exceeds the 500 MB limit."
+            exit 1
+          fi
 
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v4
@@ -101,7 +150,8 @@ jobs:
             --option-settings \
               "Namespace=aws:elasticbeanstalk:application:environment,OptionName=SSR_CLIENT_ID,Value=${SSR_CLIENT_ID}" \
               "Namespace=aws:elasticbeanstalk:application:environment,OptionName=SSR_CLIENT_SECRET,Value=${SSR_CLIENT_SECRET}" \
-              "Namespace=aws:elasticbeanstalk:application:environment,OptionName=ALCHEMY_API_KEY,Value=${ALCHEMY_API_KEY}"
+              "Namespace=aws:elasticbeanstalk:application:environment,OptionName=ALCHEMY_API_KEY,Value=${ALCHEMY_API_KEY}" \
+              "Namespace=aws:elasticbeanstalk:application:environment,OptionName=SENTRY_SERVER_INSTRUMENTATION,Value=false"
 
       - name: Check Elastic Beanstalk health and readiness (120s warmup then 20 retries with 60s delay)
         run: |

.gitignore

@@ -2,6 +2,8 @@
 
 # dependencies
 /node_modules
+/.pnpm-store
+/.corepack-tmp
 /.pnp
 .pnp.js
 

.platform/hooks/prebuild/01-bypass-eb-npm-install.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+if [[ ! -f package.json ]]; then
+  exit 0
+fi
+
+mv package.json package.json.seize-real
+
+cat > package.json <<'EOF'
+{
+  "name": "6529-eb-noop-install",
+  "private": true,
+  "version": "1.0.0"
+}
+EOF

Procfile

@@ -0,0 +1 @@
+web: PORT=3001 HOSTNAME=0.0.0.0 node server.js

README.md

@@ -52,7 +52,9 @@ again to approve the updated file.
 From the repo root, you should be able to run:
 
 ```bash
+which 6529
 which ghruns
+6529 run dev --help
 ghruns
 ```
 
@@ -98,22 +100,64 @@ Are you sure you want to deploy <branch-name> to production?
 
 If you confirm, it triggers the production workflow from `.github/workflows/build-upload-deploy-prod.yml` against your current branch.
 
-PORT: 3000
+Default app port: `3001`.
 
 ### Documentation
 
 User-facing documentation lives in [`docs/README.md`](docs/README.md).
+Developer package-management guidance lives in [`docs/developer/pnpm-and-socket-firewall.md`](docs/developer/pnpm-and-socket-firewall.md).
 
 ### Install
 
+Bootstrap the repo command shim, ensure Socket Firewall is installed, and
+activate the pinned pnpm version:
+
+```bash
+./bin/6529 bootstrap
 ```
-npm i
+
+Then open a new shell, or activate the current shell immediately:
+
+```bash
+source <(./bin/6529 bootstrap --print-export)
 ```
 
-### Build
+Then install project dependencies through the secure path:
 
+```bash
+6529 install
 ```
-npm run build
+
+To add a new package:
+
+```bash
+6529 add <package>
+6529 add -D <package>
+```
+
+`6529 install` and `6529 i` only reinstall the existing dependency set. They do
+not accept package names. To add a dependency, use `6529 add <package>`.
+`6529 add` goes through the same Socket Firewall protected path as secure
+installs.
+
+Plain `pnpm install`, `pnpm dev`, and `npm run ...` repo script execution are intentionally blocked. Use the `6529` wrapper only.
+
+If `direnv` is enabled for the repo, you can also use the repo-local wrapper:
+
+```bash
+6529 install
+6529 run dev
+6529 run build
+6529 approve-builds
+6529 staging
+```
+
+Otherwise, open a new shell after running `./bin/6529 bootstrap`.
+
+### Build
+
+```bash
+6529 run build
 ```
 
 ### Environment
@@ -134,7 +178,7 @@ gateway usage:
 
 To test end-to-end:
 
-1. Run `npm run dev`.
+1. Run `6529 run dev`.
 2. Paste any pepe.wtf link in chat, for example `https://pepe.wtf/asset/GOXPEPE`
    or `https://pepe.wtf/artists/Easy-B`, and confirm the preview renders with
    imagery and stats.
@@ -145,20 +189,47 @@ To test end-to-end:
 
 - Locally
 
+```bash
+6529 run dev
 ```
-npm run dev
+
+- Staging update / rebuild
+
+```bash
+./bin/6529 staging
 ```
 
-- Production
+This rebuilds the app and restarts PM2 on the standalone runtime path
+(`6529 run start:standalone`).
+
+- One-time server bootstrap for plain `6529 ...`
+
+```bash
+./bin/6529 bootstrap
+```
 
+Then open a new shell, or source the rc file that matches your shell.
+
+- After `direnv allow`, the shorthand also works
+
+```bash
+6529 staging
 ```
-npm run start
+
+- Production
+
+```bash
+6529 run start
 ```
 
+This is the repo-local production-style start path.
+Elastic Beanstalk production deploys do not use `6529 run start`; they package
+Next standalone output and start `server.js` through [`Procfile`](./Procfile).
+
 ### RUN USING PM2
 
-```
-pm2 start npm --name=6529seize -- run start
+```bash
+pm2 start bash --name=6529seize -- -lc 'cd /path/to/repo && ./bin/6529 run start:standalone'
 ```
 
 ## Directory Structure

__tests__/contexts/TitleContext.test.tsx

@@ -117,4 +117,24 @@ describe("TitleContext", () => {
       expect(document.title).toBe("Messages | Brain");
     });
   });
+
+  it("uses the discovery route title instead of the profile fallback", async () => {
+    mockPathname = "/discover";
+    mockSearchParams = new URLSearchParams();
+    mockActiveWaveId = null;
+
+    render(
+      <TitleProvider>
+        <DynamicHeadTitle />
+        <TitleHarness waveData={null} />
+      </TitleProvider>
+    );
+
+    await waitFor(() => {
+      expect(screen.getByText("Discovery")).toBeInTheDocument();
+    });
+    await waitFor(() => {
+      expect(document.title).toBe("Discovery");
+    });
+  });
 });

app/notifications/page.tsx

@@ -25,10 +25,14 @@ export default async function NotificationsPage() {
     !notificationsFetched ||
     +notificationsFetched < Time.now().toMillis() - 60000
   ) {
-    await prefetchAuthenticatedNotifications({
-      queryClient,
-      headers,
-    });
+    try {
+      await prefetchAuthenticatedNotifications({
+        queryClient,
+        headers,
+      });
+    } catch (error) {
+      console.warn("Notifications prefetch failed", { error });
+    }
   }
 
   return (