[michft]

Issue

Closes #63

What changed and why

Release Smoke regenerates the lockfile from scratch. New upstream releases now satisfy the declared ranges for three patched packages, so pnpm stops using the patches and fails with ERR_PNPM_UNUSED_PATCH. This breaks Check on main and on every PR, including #62.

 pnpm-workspace.yaml  overrides:
   expo-modules-core: 58.0.22
+  expo-network: 58.0.3
+  node-pty: 1.2.0-beta.15
+  "@expo/fingerprint": 0.21.5

This matches upstream's fix (pingdotgg/t3code#23798, "pin all patched package versions"). The next Nightly sync replaces this block with upstream's full list. pnpm-lock.yaml changes only the overrides section and the matching specifiers; the scripts importer entry for @t3tools/client-runtime only moved position.

Merge danger: two-way door. Blast radius: dependency resolution. The installed versions are unchanged (they were already these exact versions in the lockfile).

Validation

• Before: main push run 40144492012, and feat(mobile): Spaces on the iPad sidebar #62 run 40146914469 → Release Smoke ERR_PNPM_UNUSED_PATCH.
• After: node scripts/release-smoke.ts locally → Release smoke checks passed.
• vp run check:changed: format and typecheck (32 packages) pass; knip skipped (no code changed).
• Docstring coverage: not applicable, no code changed.

Quality evidence

{
  "author_agent": "claude-code:thread:09d5a283-2826-440e-a525-88be6a9fc6c0",
  "readme": {
    "status": "not-needed",
    "reason": "Build configuration only; README does not cover dependency pins.",
    "files": []
  },
  "changelog": {
    "status": "not-needed",
    "reason": "No user-visible change; installed versions are unchanged.",
    "files": []
  },
  "validation": "Release smoke failed on main (run 40144492012) and #62 (run 40146914469) with ERR_PNPM_UNUSED_PATCH; node scripts/release-smoke.ts now passes locally. vp run check:changed: format and typecheck pass, knip skipped. Docstring coverage not applicable (no code).",
  "design": "Three override pins, the same mechanism and versions upstream uses (pingdotgg/t3code#23798), instead of porting upstream's whole list early and widening the Nightly diff.",
  "regression": "Dependency resolution only; web, desktop, mobile, server, and contracts code unchanged and the lockfile already had these exact versions. Residual risk: other patched packages can drift the same way until the Nightly sync brings upstream's full pin list."
}

Checklist

• Linked an accepted issue in michft/t3-even-g2
• Kept changes within its acceptance criteria
• Recorded relevant validation and remaining gaps
• Updated affected user or contributor guides

Claude Opus 5.5, Claude Code harness in T3 Code.

🤖 Generated with Claude Code

[michft]

Independent review of the final revision (round 1: PASS).

{
  "head_sha": "ed0d99158d49ed28a86252ce067fcbcaee73b63c",
  "body_sha256": "ccbe8f80c63876b253041e80afdcf3a33626e41eb7a740a4a8c615b178d7f8cd",
  "reviewer_agent": "codex:session:01a1707e-b9b1-76f3-a176-4f354d9cb011 (t3-delegated-task:pr64-review-round1)",
  "model": "gpt-6.1-sol (high reasoning)",
  "harness": "Codex harness in T3 Code",
  "result": "pass",
  "findings": "No findings. Pins match upstream t3/main and the patch files; lockfile changes only the three overrides, two specifiers, and a moved scripts importer entry. Reviewer ran node scripts/release-smoke.ts: passed; a fresh resolution left none of the 28 configured patches unused. Gaps: CI and merge readiness not assessed by reviewer; pre-fix failures and author's typecheck taken from evidence."
}

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: michft/t3-even-g2
• Branch: fix/pin-patched-deps
• File: .coderabbit.config.ts
• Commit: ed0d991
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Essentials
• Run ID: e6133f81-23b9-4cc5-bd6a-4a1915e3c4d6

Commits

Reviewing files that changed from the base of the PR and between 5e054e3 and ed0d991.

Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

Files selected for processing: 1

• pnpm-workspace.yaml

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

Walkthrough

The workspace adds override pins for expo-network, node-pty, and @expo/fingerprint. Comments describe their relationship to patched packages, lockfile-free release installs, and a planned nightly replacement.

Changes: Dependency overrides

Layer / File(s)	Summary
Add dependency override pins pnpm-workspace.yaml	Adds overrides for expo-network 58.0.3, node-pty 1.2.0-beta.15, and @expo/fingerprint 0.21.5. Comments describe the patch relationship and planned nightly replacement.

Priority: High

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Bug fix · Severity of issue fixed: High

Suggested reviewers: juliusmarminge

Merge Risk: Minimal · up to ed0d9

The dependency pins are consistent with the stated release-install fix and no merge-blocking issue remains.

Pre-merge checks: 3 · 1

Failed checks: 1 inconclusive

Check name	Status	Explanation	Resolution
Linked Issues check		Issue #63 requires pins for expo-network@58.0.3, node-pty@1.2.0-beta.15, and @expo/fingerprint@0.21.5 in pnpm-workspace.yaml. The change summary confirms all three pins. The author reports tha…	Provide a successful CI Release Smoke result for this pull request, or otherwise provide reviewable evidence that the CI requirement passes.

Passed checks: 3 passed

Check name	Status	Explanation
Title check		The title clearly and concisely identifies the primary dependency change: pinning three patched packages.
Description check		The description is complete and relevant. It includes the linked issue, change rationale, scope, validation results, quality evidence, checklist status, and residual risks. The UI evidence section is …
Out of Scope Changes check		The reviewed change adds only the three dependency overrides in pnpm-workspace.yaml. These overrides directly implement issue #63. The summary reports no unrelated code or public-entity changes.

Full details: Description check

Explanation

The description is complete and relevant. It includes the linked issue, change rationale, scope, validation results, quality evidence, checklist status, and residual risks. The UI evidence section is omitted, but no UI changes are involved.

Full details: Linked Issues check

Explanation

Issue #63 requires pins for expo-network@58.0.3, node-pty@1.2.0-beta.15, and @expo/fingerprint@0.21.5 in pnpm-workspace.yaml. The change summary confirms all three pins. The author reports that local Release Smoke passes. No CI result for this pull request is available, so the required CI result cannot be confirmed.

Resolution

Provide a successful CI Release Smoke result for this pull request, or otherwise provide reviewable evidence that the CI requirement passes.

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.9 KiB	20.9 KiB	0 B (0.0%)	29.3 KiB	✅
Codex	Live turn messages	2	2	0 (0.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	−7 B (−0.1%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	−7 B (−0.6%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.2 KiB	21.2 KiB	0 B (0.0%)	29.3 KiB	✅
Claude	Live turn messages	2	2	0 (0.0%)	8	✅

Baseline: 8596808 · PR result: ed0d991 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[michft]

Runtime evidence: the patched packages still load and work

#64 only changes how versions are pinned. Below, each of the three patches is checked from this PR's checkout (ed0d991, pnpm install --frozen-lockfile) against an isolated dev server (.t3 in the workspace, not live userdata).

Package	Patch purpose	Platform it affects	Check
node-pty@1.2.0-beta.15	Windows ConPTY kill without timeouts (#18519)	Windows server	Web terminal opens a shell through the server; require.resolve('node-pty') in that shell is the patched copy (_patch_hash=f1e680af…); the pty reports its size. The patched code paths are Windows-only, so this proves loading and normal PTY use on macOS, not the Windows fix.
expo-network@58.0.3	Synchronise NWPathMonitor path handoff (#22043)	iOS native	iPad Air 13 (iOS 27) dev client is compatible with this checkout's native fingerprint, which hashes the patched expo-network/ios directory. Metro from this checkout loaded, and the app paired and listed threads. Upstream's regression (apps/mobile/scripts/fixtures/NetworkModuleRegression.swift, compiled with -sanitize=thread against this checkout's patched NetworkModule.swift): first passed, offline passed, concurrent passed.
@expo/fingerprint@0.21.5	Android fingerprint covers Expo native modules (#20384)	Build tooling, no UI	Resolves to the patched copy (_patch_hash=8fba80d6…); the Android fingerprint includes 57 sources from Expo autolinking, among them expo-network/android and expo-modules-core/android.

Web: terminal on the patched node-pty

iPad: T3 Code Dev from this checkout, connected and listing threads

Gaps: I did not run Windows or Android here (this host has no Android SDK), so the node-pty and fingerprint fixes are checked by which copy loads and what it hashes, not by behaviour on those platforms.

[michft]

Build and installation checks

All from a fresh JJ workspace at ed0d991 with no node_modules, on macOS arm64. CI's Linux Build desktop pipeline and Release Smoke (fresh resolution without the lockfile) already pass on this head.

Check	Result
Clean install: pnpm install --frozen-lockfile	Passed in 17.7s; pnpm-lock.yaml unchanged; all 28 patchedDependencies installed as _patch_hash copies, no ERR_PNPM_UNUSED_PATCH.
Desktop package: vp run dist:desktop:dmg:arm64 (unsigned)	Built T3-Code-0.1.1-arm64.dmg and .zip in 71s.
Desktop install	Mounted the DMG read-only and copied T3 Code (Beta).app to a scratch folder (not /Applications). Bundled node-pty is 1.2.0-beta.15 with an arm64 pty.node and spawn-helper; all 26 lines the patch adds are present. Running the installed app's Electron 44.9.3 binary in node mode (no app window, scratch HOME), the bundled node-pty spawned a shell: 30 100, pty-ok, exit 0.
iOS native: forced rebuild and install (mobile-native-client.ts ensure ios, record cleared)	** BUILD SUCCEEDED ** in 3m03s; compiled expo-network@58.0.3_patch_hash=cd09b6d1…/ios/NetworkModule.swift; installed a new binary on the iPad Air 13 (iOS 27) simulator with fingerprint add639f9….
iOS run	The rebuilt app loaded this checkout's Metro bundle, reconnected to the isolated server, and listed its threads (below).

Not covered: I didn't launch the packaged desktop app's window, to avoid sharing state with the T3 Code instance in use on this machine. Signed and notarized builds, Windows, and Android (no SDK on this host) were also not tested.