openclaw/pnpm-workspace.yaml

Multi-channel AI gateway with extensible messaging integrations

packages:
  - .
  - ui
  - packages/*
  - extensions/*
  - examples/*

minimumReleaseAge: 10080
minimumReleaseAgeStrict: true

# Trusted Codex runtimes are outside the dependency cooldown.
minimumReleaseAgeExclude:
  - "@openai/codex"
  - "@openai/codex-*"
  # Reviewed fs-safe 0.26.0 release and native helpers; remove after 2026-10-17T20:00:18.006Z.
  - "@openclaw/fs-safe@0.26.0"
  - "@openclaw/fs-safe-darwin-arm64@0.26.0"
  - "@openclaw/fs-safe-darwin-x64@0.26.0"
  - "@openclaw/fs-safe-freebsd-arm64@0.26.0"
  - "@openclaw/fs-safe-freebsd-x64@0.26.0"
  - "@openclaw/fs-safe-linux-arm64-gnu@0.26.0"
  - "@openclaw/fs-safe-linux-arm64-musl@0.26.0"
  - "@openclaw/fs-safe-linux-x64-gnu@0.26.0"
  - "@openclaw/fs-safe-linux-x64-musl@0.26.0"
  - "@openclaw/fs-safe-win32-arm64-msvc@0.26.0"
  - "@openclaw/fs-safe-win32-x64-msvc@0.26.0"

# Isolated installs let pnpm reuse whole-package APFS clones instead of relinking every file.
nodeLinker: isolated
# Private inodes keep sibling installs from changing compiler input ctimes.
packageImportMethod: clone-or-copy
# GWTs share node_modules; script commands must not reconcile that shared install.
verifyDepsBeforeRun: false
blockExoticSubdeps: true

overrides:
  "@microsoft/teams.apps@2.1.0>@azure/msal-node": 7.1.1
  "@azure/identity@4.13.3>@azure/msal-node": 7.1.1
  # Memory LanceDB supplies vectors; WhatsApp prepares thumbnails with Rastermill.
  "@lancedb/lancedb>@huggingface/transformers": "-"
  "baileys>sharp": "-"
  "baileys>audio-decode": 3.12.0
  "chevrotain>lodash-es": 4.18.1
  "@chevrotain/cst-dts-gen>lodash-es": 4.18.1
  "@chevrotain/gast>lodash-es": 4.18.1
  "@agentclientprotocol/codex-acp@2.1.1>@openai/codex": 0.160.0
  "@codemirror/commands@6.11.1>@codemirror/view": 6.43.13
  "@codemirror/view@6.43.13>@codemirror/state": 6.7.6
  "@anthropic-ai/sdk": 0.131.0
  "@anthropic-ai/vertex-sdk@0.20.2>google-auth-library": 11.1.0
  "@opentelemetry/core": 2.11.0
  "@opentelemetry/propagator-jaeger": 2.11.0
  "@aws-sdk/core": 3.978.1
  "@aws-sdk/credential-provider-node": 3.972.84
  "@aws-sdk/xml-builder": 3.972.41
  "@hono/node-server": 2.1.3
  axios: 1.20.0
  # Reject malformed URI schemes/hosts and preserve relative reference semantics.
  # GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h, GHSA-333x-w4r6-6crp.
  fast-uri: 4.2.3
  follow-redirects: 1.16.1
  defu: 6.1.7
  fast-xml-parser: 5.11.2
  request: "npm:@cypress/request@4.0.1"
  request-promise: "npm:@cypress/request-promise@5.0.0"
  basic-ftp: 6.2.1
  brace-expansion: 5.0.12
  # GHSA-68fv-2mgg-jv7q: source-map-js <1.2.2 event-loop DoS (via css-tree).
  source-map-js: 1.2.2
  file-type: 22.1.1
  form-data: 4.0.6
  ip-address: 10.7.3
  "mailauth@7.1.0>nodemailer": 10.1.4
  "mailparser@3.9.33>nodemailer": 10.1.4
  minimatch: 10.2.6
  path-to-regexp: 8.4.2
  proxy-addr: 2.0.8
  qs: 6.16.0
  node-domexception: "npm:@nolyfill/domexception@1.0.28"
  typebox: 1.3.34
  tar: 7.5.22
  tough-cookie: 6.0.2
  "tsdown>rolldown-plugin-dts": 0.28.6
  # Keep both Lit analyzers on the same classic compiler until they support native TS7.
  "web-component-analyzer@2.0.0>typescript": 5.9.3
  "zca-js@2.2.0>tough-cookie": 6.0.2
  yauzl: 3.4.0
  protobufjs: 8.8.0
  uuid: 14.0.2

allowBuilds:
  onnxruntime-node: false
  "@google/genai": true
  "@lydell/node-pty": true
  "@matrix-org/matrix-sdk-crypto-nodejs": true
  "@tloncorp/api": true
  "@tloncorp/tlon-skill": true
  baileys: true
  authenticate-pam: true
  "@discordjs/opus": false
  esbuild: true
  koffi: false
  protobufjs: true
  tree-sitter-bash: false
  openclaw: true
  "@openclaw/proxyline": true
  clawpdf: true
  "@openclaw/crabline": true
  rastermill: true
  node-pty: true

packageExtensions:
  # The transient npm lock generator also needs the peer marked optional.
  baileys:
    peerDependenciesMeta:
      sharp:
        optional: true
  # lit-analyzer imports the classic compiler without declaring it; match its analyzer dependency.
  "lit-analyzer@2.0.3":
    dependencies:
      typescript: 5.9.3

patchedDependencies:
  "@discord/embedded-app-sdk@2.5.0": patches/@discord__embedded-app-sdk@2.5.0.patch
  "baileys@7.0.0-rc14": patches/baileys@7.0.0-rc14.patch
  "matrix-js-sdk@42.4.0": patches/matrix-js-sdk@42.4.0.patch
  "@novnc/novnc@1.7.0": patches/@novnc__novnc@1.7.0.patch
  vitest@5.0.1: patches/vitest@5.0.1.patch
  "@awesome.me/webawesome@3.13.0": patches/@awesome.me__webawesome@3.13.0.patch
  ghostty-web@0.4.0: patches/ghostty-web@0.4.0.patch
  chrome-devtools-mcp@1.10.1: patches/chrome-devtools-mcp@1.10.1.patch
  zod@3.25.76: patches/zod@3.25.76.patch