@overdeck/desktop 0.62.0 → 0.62.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overdeck/desktop",
-  "version": "0.62.0",
+  "version": "0.62.1",
   "description": "Overdeck Command Deck — AI agent monitoring desktop app",
   "publishConfig": {
     "access": "public"

package/server/{merge-train-2WUgME6h.js → merge-train-I2N9TlqX.js}

@@ -1,2 +1,2 @@
-import { a as getMergeTrainConfigPayload, c as getPendingAutoMergePayload, d as postMergeTrainAssemblePayload, f as postMergeTrainConfigPayload, i as getAutoMergeProblemPayload, l as mergeTrainRouteLayer, m as postMergeTrainMergeNextPayload, n as deleteAutoMergePayload, o as getMergeTrainGenerationsPayload, p as postMergeTrainGenerationShipPayload, r as getAutoMergePolicyPayload, s as getMergeTrainQueuesPayload, t as autoMergePolicyRefusal, u as postAutoMergeSchedulePayload } from "./merge-train-DwYhNytU.js";
+import { a as getMergeTrainConfigPayload, c as getPendingAutoMergePayload, d as postMergeTrainAssemblePayload, f as postMergeTrainConfigPayload, i as getAutoMergeProblemPayload, l as mergeTrainRouteLayer, m as postMergeTrainMergeNextPayload, n as deleteAutoMergePayload, o as getMergeTrainGenerationsPayload, p as postMergeTrainGenerationShipPayload, r as getAutoMergePolicyPayload, s as getMergeTrainQueuesPayload, t as autoMergePolicyRefusal, u as postAutoMergeSchedulePayload } from "./merge-train-pMKZ_hti.js";
 export { autoMergePolicyRefusal, mergeTrainRouteLayer as default, mergeTrainRouteLayer, deleteAutoMergePayload, getAutoMergePolicyPayload, getAutoMergeProblemPayload, getMergeTrainConfigPayload, getMergeTrainGenerationsPayload, getMergeTrainQueuesPayload, getPendingAutoMergePayload, postAutoMergeSchedulePayload, postMergeTrainAssemblePayload, postMergeTrainConfigPayload, postMergeTrainGenerationShipPayload, postMergeTrainMergeNextPayload };

package/server/{merge-train-DwYhNytU.js → merge-train-pMKZ_hti.js}

@@ -219,7 +219,7 @@ async function getMergeTrainQueuesPayload() {
 /** PAN-1696 AC2: per-project generation chains across every tracked project. */
 async function getMergeTrainGenerationsPayload() {
 	const { isMergeTrainEnabledForProject } = await import("./merge-sync-GeddtnBd.js");
-	const { getUatGenerationsPayload } = await import("./uat-train-CuZLaq2g.js");
+	const { getUatGenerationsPayload } = await import("./uat-train-tiJ_fEPf.js");
 	return (await Promise.allSettled(listProjectsSync().map(async ({ key, config }) => ({
 		projectKey: key,
 		projectName: config.name,
@@ -306,7 +306,7 @@ async function postMergeTrainAssemblePayload(payload) {
 			status: 404,
 			body: { error: `Unknown project key: ${projectKey}` }
 		};
-		const { runUatTrainReconcile } = await import("./uat-train-CuZLaq2g.js");
+		const { runUatTrainReconcile } = await import("./uat-train-tiJ_fEPf.js");
 		return {
 			status: 200,
 			body: { projects: [{
@@ -318,7 +318,7 @@ async function postMergeTrainAssemblePayload(payload) {
 			}] }
 		};
 	}
-	const { runUatTrainReconcileAllProjects } = await import("./uat-train-CuZLaq2g.js");
+	const { runUatTrainReconcileAllProjects } = await import("./uat-train-tiJ_fEPf.js");
 	return {
 		status: 200,
 		body: { projects: await runUatTrainReconcileAllProjects({ force: true }) }
@@ -368,7 +368,7 @@ const postMergeTrainGenerationStackRoute = HttpRouter.add("POST", "/api/merge-tr
 	const authError = rejectUnsafeDashboardMutationRequest(yield* HttpServerRequest.HttpServerRequest);
 	if (authError) return authError;
 	const name = uatGenerationNameFromParam((yield* HttpRouter.params)["name"] ?? "");
-	const { postUatGenerationStackPayload } = yield* Effect.promise(() => import("./uat-train-CuZLaq2g.js"));
+	const { postUatGenerationStackPayload } = yield* Effect.promise(() => import("./uat-train-tiJ_fEPf.js"));
 	const result = yield* Effect.promise(() => postUatGenerationStackPayload(name));
 	if (!result.ok) return jsonResponse({ error: result.error }, { status: result.status });
 	return jsonResponse({
@@ -385,7 +385,7 @@ const postMergeTrainGenerationPromoteRoute = HttpRouter.add("POST", "/api/merge-
 	const rawShipVersion = parsed.body["shipVersion"];
 	if (rawShipVersion !== void 0 && (typeof rawShipVersion !== "string" || !/^\d+\.\d+\.\d+$/.test(rawShipVersion))) return jsonResponse({ error: "shipVersion must look like 48.8.0" }, { status: 400 });
 	const name = uatGenerationNameFromParam((yield* HttpRouter.params)["name"] ?? "");
-	const { postUatGenerationPromotePayload } = yield* Effect.promise(() => import("./uat-train-CuZLaq2g.js"));
+	const { postUatGenerationPromotePayload } = yield* Effect.promise(() => import("./uat-train-tiJ_fEPf.js"));
 	const { firePostMergeLifecycle } = yield* Effect.promise(() => import("./specialists-C7M9CdDA.js"));
 	const result = yield* Effect.promise(() => postUatGenerationPromotePayload(name, firePostMergeLifecycle, rawShipVersion));
 	if (!result.success) return jsonResponse(result, { status: result.reason === "not-found" ? 404 : result.reason === "merge-failed" ? 500 : 409 });
@@ -726,4 +726,4 @@ const mergeTrainRouteLayer = Layer.mergeAll(getMergeTrainQueuesRoute, getMergeTr
 //#endregion
 export { getMergeTrainConfigPayload as a, getPendingAutoMergePayload as c, postMergeTrainAssemblePayload as d, postMergeTrainConfigPayload as f, getAutoMergeProblemPayload as i, mergeTrainRouteLayer as l, postMergeTrainMergeNextPayload as m, deleteAutoMergePayload as n, getMergeTrainGenerationsPayload as o, postMergeTrainGenerationShipPayload as p, getAutoMergePolicyPayload as r, getMergeTrainQueuesPayload as s, autoMergePolicyRefusal as t, postAutoMergeSchedulePayload as u };
 
-//# sourceMappingURL=merge-train-DwYhNytU.js.map
+//# sourceMappingURL=merge-train-pMKZ_hti.js.map

package/server/node_modules/.package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@overdeck/desktop-server",
-  "version": "0.62.0",
+  "version": "0.62.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
@@ -395,9 +395,9 @@
       }
     },
     "node_modules/ansi-regex": {
-      "version": "6.3.0",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.3.0.tgz",
-      "integrity": "sha512-WpDfL7NO6j7tH88IDBNVdUJxDh9nmCteAVW9dsep846XdwF4naCBK+/tGLX3KJgcpgMRXCFlTM2hKGoK9FsdrQ==",
+      "version": "6.4.0",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.4.0.tgz",
+      "integrity": "sha512-KzTVk2tCWAHtYrvvvaP8bJKJq2pVinhLcGEQdtLIYPbmNGNyYe8QwNaTUYQp2J7/vIsUKt5QCqAfUkYyG9DkOw==",
       "license": "MIT",
       "engines": {
         "node": ">=12"
@@ -2006,9 +2006,9 @@
       "license": "ISC"
     },
     "node_modules/ws": {
-      "version": "8.21.3",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.3.tgz",
-      "integrity": "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==",
+      "version": "8.22.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.22.0.tgz",
+      "integrity": "sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"

package/server/node_modules/ansi-regex/index.js

@@ -2,9 +2,9 @@ export default function ansiRegex({onlyFirst = false} = {}) {
 	// Valid string terminator sequences are BEL, ESC\, and 0x9c
 	const ST = '(?:\\u0007|\\u001B\\u005C|\\u009C)';
 
-	// OSC sequences only: ESC ] ... ST
-	// The payload stops at the first terminator character rather than scanning ahead for one, so an unterminated `ESC ]` cannot rescan the rest of the input. Terminals likewise abort a control string on an unexpected ESC.
-	const osc = `(?:\\u001B\\][^\\u0007\\u001B\\u009C]*${ST})`;
+	// OSC sequences only: ESC ] ... ST (or the C1 introducer 0x9d ... ST)
+	// The payload stops at the first terminator character rather than scanning ahead for one, so an unterminated `ESC ]` cannot rescan the rest of the input. Terminals likewise abort a control string on an unexpected ESC. The payload also stops at 0x9d so an unterminated C1 OSC cannot swallow the next one.
+	const osc = `(?:(?:\\u001B\\]|\\u009D)[^\\u0007\\u001B\\u009C\\u009D]*${ST})`;
 
 	// CSI and related: ESC/C1, optional intermediates, optional params (supports ; and :) then final byte
 	const csi = '[\\u001B\\u009B][[\\]()#;?]*(?:\\d{1,4}(?:[;:]\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]';

package/server/node_modules/ansi-regex/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "ansi-regex",
-	"version": "6.3.0",
+	"version": "6.4.0",
 	"description": "Regular expression for matching ANSI escape codes",
 	"license": "MIT",
 	"repository": "chalk/ansi-regex",

package/server/node_modules/ws/lib/websocket.js

@@ -75,11 +75,24 @@ class WebSocket extends EventEmitter {
       this._redirects = 0;
 
       if (protocols === undefined) {
-        protocols = [];
+        if (!options || options.protocols === undefined) {
+          protocols = [];
+        } else if (Array.isArray(options.protocols)) {
+          protocols = options.protocols;
+        } else {
+          protocols = [options.protocols];
+        }
       } else if (!Array.isArray(protocols)) {
         if (typeof protocols === 'object' && protocols !== null) {
           options = protocols;
-          protocols = [];
+
+          if (options.protocols === undefined) {
+            protocols = [];
+          } else if (Array.isArray(options.protocols)) {
+            protocols = options.protocols;
+          } else {
+            protocols = [options.protocols];
+          }
         } else {
           protocols = [protocols];
         }
@@ -318,7 +331,6 @@ class WebSocket extends EventEmitter {
       return;
     }
 
-    this._readyState = WebSocket.CLOSING;
     this._sender.close(code, data, !this._isServer, (err) => {
       //
       // This error is handled by the `'error'` listener on the socket. We only
@@ -336,6 +348,7 @@ class WebSocket extends EventEmitter {
       }
     });
 
+    this._readyState = WebSocket.CLOSING;
     setCloseTimer(this);
   }
 
@@ -681,6 +694,7 @@ function initAsClient(websocket, address, protocols, options) {
     socketPath: undefined,
     hostname: undefined,
     protocol: undefined,
+    protocols: undefined,
     timeout: undefined,
     method: 'GET',
     host: undefined,

package/server/node_modules/ws/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ws",
-  "version": "8.21.3",
+  "version": "8.22.0",
   "description": "Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js",
   "keywords": [
     "HyBi",

package/server/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@overdeck/desktop-server",
-  "version": "0.62.0",
+  "version": "0.62.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@overdeck/desktop-server",
-      "version": "0.62.0",
+      "version": "0.62.1",
       "dependencies": {
         "@effect/platform-node": "4.0.0-beta.73",
         "@google-cloud/speech": "7.5.0",
@@ -775,9 +775,9 @@
       }
     },
     "node_modules/ansi-regex": {
-      "version": "6.3.0",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.3.0.tgz",
-      "integrity": "sha512-WpDfL7NO6j7tH88IDBNVdUJxDh9nmCteAVW9dsep846XdwF4naCBK+/tGLX3KJgcpgMRXCFlTM2hKGoK9FsdrQ==",
+      "version": "6.4.0",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.4.0.tgz",
+      "integrity": "sha512-KzTVk2tCWAHtYrvvvaP8bJKJq2pVinhLcGEQdtLIYPbmNGNyYe8QwNaTUYQp2J7/vIsUKt5QCqAfUkYyG9DkOw==",
       "license": "MIT",
       "engines": {
         "node": ">=12"
@@ -2438,9 +2438,9 @@
       "license": "ISC"
     },
     "node_modules/ws": {
-      "version": "8.21.3",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.3.tgz",
-      "integrity": "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==",
+      "version": "8.22.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.22.0.tgz",
+      "integrity": "sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"

package/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overdeck/desktop-server",
-  "version": "0.62.0",
+  "version": "0.62.1",
   "private": true,
   "type": "module",
   "dependencies": {

package/server/server.js

@@ -1,7 +1,7 @@
 import { a as __toCommonJS, n as __esmMin, o as __toESM, r as __exportAll, t as __commonJSMin } from "./rolldown-runtime-DNCzzKnI.js";
 import { $ as isAgentSessionName, An as getModelEffortLevels, B as parsePullRequestRef, Cr as init_paths, Ct as PIPELINE_MEMBERSHIP_LOADING_CODE, Dt as getDefaultTtsDaemonConfig, En as resolveModel, Er as packageRoot, Et as getDefaultDocsConfig, F as init_js_yaml, G as isAgentRole, H as COMPANION_TERMINAL_CLOSE_BODY_KEYS, Ht as TieredExecutionConfigError, I as yaml, Jt as canUseHarness, K as COMPOSER_COMMAND_MANIFEST, L as mergeConfigs, Lt as mergeTtsDaemonConfigs, Mn as init_model_capabilities, N as init_errors, Nn as modelSupportsImages, On as MODEL_CAPABILITIES, P as require_dist$1, Pn as resolveModelId, R as init_src, Rt as DEFAULT_CONFIG$1, S as FsError, Sn as computeModelOrigin, Sr as getOverdeckHome, St as AgentSnapshot, Tr as isDevMode, U as COMPANION_TERMINAL_OPEN_BODY_KEYS, Ut as init_tier_table, V as repoFromRemoteUrl, Vn as MODEL_DEPRECATIONS, Wt as resolveTieredExecutionBlock, Xn as PARENT_MODEL_REF, Xt as init_harness_policy, Yn as COMPLIANCE_MODES, Z as getHarnessBehavior, Zn as ROLE_EFFORTS, _ as updateConversationsConfig, _r as getDocsBudgetStatePath, a as getGlobalConfigPath, an as getProviderForModel, ar as LOGS_DIR, bn as RETIRED_SUB_ROLES, br as getDocsTelemetryPath, bt as resolveEffectivePullRequest, dt as PanRpcError, en as UnknownModelError, et as ContextLayerSaveRequest, ft as PanRpcGroup, gn as init_registry, gt as SystemHealthSnapshot, h as loadConfigSync, hn as defaultBackgroundAiFeatures, hr as activeDeploymentRepoRoot, ht as DomainEvent, i as getConversationsConfig, jn as hasModelCapability, k as ProcessSpawnError, m as loadConfigNoMigration, mn as init_openai_compatible_proxy, mt as EDITORS, n as clearConfigCache, nn as getBuiltInDefaultHarness, o as getOpenInEditorCommand, on as init_providers, or as OVERDECK_HOME, p as isTldrEnabled, pn as getDashScopeUpstreamBaseUrl, pr as SYNC_SOURCES, pt as WS_METHODS, q as compareIssueIds, qt as validateTieredExecutionConfig, r as getConversationSearchConfig, rn as getKimiAnthropicBaseUrl, t as init_config_yaml, tt as ContextPreviewRequest, u as init_load, vn as DEFAULT_ROLES, vr as getDocsDisableStatePath, vt as MemoryObservation, wr as isDeploymentGenerationRoot, xt as AgentRuntimeSnapshot, yn as DEFAULT_WORKHORSES, yr as getDocsIndexPath, z as isConfiguredPullRequestRepo } from "./config-yaml-eISZeFuh.js";
 import { A as init_boot_gates, D as getOverdeckDatabasePath, E as OVERDECK_MIGRATION_PATH, M as resolveBootGates, O as init_paths$1, d as dropPipelineStateMirrorTables, i as DbLive, j as isPeerDashboardProcess, k as formatBootGateState, l as TmuxLive, p as init_infra, u as dropDeadIssuesForeignKeys } from "./infra-DEg0Pwsm.js";
-import { d as getDashboardIdentity, f as isNonPrimaryCheckoutRoot, l as startUatTrainReconciler, m as shouldRefuseHostDashboardPort, p as readHostDashboardApiPort, u as stopUatTrainReconciler } from "./uat-train-Bik_I85J.js";
+import { d as getDashboardIdentity, f as isNonPrimaryCheckoutRoot, l as startUatTrainReconciler, m as shouldRefuseHostDashboardPort, p as readHostDashboardApiPort, u as stopUatTrainReconciler } from "./uat-train-BORW2R0A.js";
 import { a as validateOrigin$1, c as jsonStringResponse, o as validateOriginHeaders, r as isTrustedOriginForHost, s as jsonResponse, t as getHeaderFromMap } from "./origin-validation-DzzAfBTF.js";
 import { c as loadConfigSync$1, n as getDashboardApiUrl, o as init_config } from "./config-Q5xnOeq2.js";
 import { a as emitActivityTts, o as emitDashboardLifecycle, r as emitActivityEntry, s as init_activity_logger, t as appendDomainEventAsync } from "./activity-logger-89A9ZC2h.js";
@@ -122,7 +122,7 @@ import { n as isRemoteAvailable, t as createFlyProviderFromConfig } from "./remo
 import { t as detectProviderEnvConflicts } from "./claude-settings-overlay-Cl8Xq_sf.js";
 import { a as projectIdFromPath, i as parentSessionIdFromPath, n as dimensionsForModel, o as sessionIdFromPath, r as openEmbeddingsDb } from "./conversations-search-EDX0ltxJ.js";
 import { r as getShipLog } from "./ship-log-DdnHsR67.js";
-import { l as mergeTrainRouteLayer } from "./merge-train-DwYhNytU.js";
+import { l as mergeTrainRouteLayer } from "./merge-train-pMKZ_hti.js";
 import { a as resumeFlywheel, c as readFlywheelReportFile, d as FlywheelNotRunning, f as FlywheelOrphanSession, g as resolveFlywheelProjectRoot, h as readFlywheelRun, i as requestFlywheelReport, l as readFlywheelStateFile, m as deriveFlywheelStatus, n as abortFlywheel, o as startFlywheel, p as FlywheelPausedExists, r as pauseFlywheel, s as stopFlywheel, t as computeSubstrateStats, u as FlywheelAlreadyRunning } from "./substrate-stats-beoo0bT5.js";
 import { i as appendLinearMcpAuthHealthyEvent, r as appendLinearMcpAuthCallbackRelayedEvent, s as resolveLinearMcpAuthIntervention } from "./linear-mcp-auth-Bt0bIPww.js";
 import { n as getSequencerRunStatus, r as spawnSequencerAgent, t as SEQUENCER_AGENT_ID } from "./sequencer-agent-Bf_xHy-j.js";
@@ -65570,11 +65570,11 @@ async function defaultMergeGate(issueId) {
 	return evaluateIssueMergeGate(issueId);
 }
 async function defaultPolicyRefusal() {
-	const { autoMergePolicyRefusal } = await import("./merge-train-2WUgME6h.js");
+	const { autoMergePolicyRefusal } = await import("./merge-train-I2N9TlqX.js");
 	return (issueId) => autoMergePolicyRefusal(issueId);
 }
 async function defaultSchedule(issueId, canSchedule) {
-	const [{ postAutoMergeSchedulePayload }, { scheduleAutoMergeWithResult }] = await Promise.all([import("./merge-train-2WUgME6h.js"), import("./merge-sync-GeddtnBd.js")]);
+	const [{ postAutoMergeSchedulePayload }, { scheduleAutoMergeWithResult }] = await Promise.all([import("./merge-train-I2N9TlqX.js"), import("./merge-sync-GeddtnBd.js")]);
 	return postAutoMergeSchedulePayload({ issueId }, { schedule: (input) => scheduleAutoMergeWithResult({
 		...input,
 		canSchedule

package/server/{uat-train-Bik_I85J.js → uat-train-BORW2R0A.js}

@@ -29,8 +29,8 @@ var import_toml = require_toml();
 init_boot_gates();
 function getBuildInfo() {
 	return {
-		buildCommit: "a4eeac3319fef2fd78d59d71e8eb0ba969949084",
-		builtAt: "2026-09-26T07:55:26.281Z",
+		buildCommit: "514884c9dd939158a164c88d0694fe94ec0ff99c",
+		builtAt: "2026-09-27T04:42:06.924Z",
 		buildDirty: false,
 		buildBranch: null
 	};
@@ -3835,4 +3835,4 @@ async function postUatGenerationPromotePayload(name, firePostMerge, shipVersion)
 //#endregion
 export { postUatGenerationStackPayload as a, runUatTrainReconcileAllProjects as c, getDashboardIdentity as d, isNonPrimaryCheckoutRoot as f, postUatGenerationPromotePayload as i, startUatTrainReconciler as l, shouldRefuseHostDashboardPort as m, getUatCandidatePayload as n, resolveUatProjectRoot as o, readHostDashboardApiPort as p, getUatGenerationsPayload as r, runUatTrainReconcile as s, canStartUatTrainReconciler as t, stopUatTrainReconciler as u };
 
-//# sourceMappingURL=uat-train-Bik_I85J.js.map
+//# sourceMappingURL=uat-train-BORW2R0A.js.map

package/server/{uat-train-CuZLaq2g.js → uat-train-tiJ_fEPf.js}

@@ -1,2 +1,2 @@
-import { a as postUatGenerationStackPayload, c as runUatTrainReconcileAllProjects, i as postUatGenerationPromotePayload, l as startUatTrainReconciler, n as getUatCandidatePayload, o as resolveUatProjectRoot, r as getUatGenerationsPayload, s as runUatTrainReconcile, t as canStartUatTrainReconciler, u as stopUatTrainReconciler } from "./uat-train-Bik_I85J.js";
+import { a as postUatGenerationStackPayload, c as runUatTrainReconcileAllProjects, i as postUatGenerationPromotePayload, l as startUatTrainReconciler, n as getUatCandidatePayload, o as resolveUatProjectRoot, r as getUatGenerationsPayload, s as runUatTrainReconcile, t as canStartUatTrainReconciler, u as stopUatTrainReconciler } from "./uat-train-BORW2R0A.js";
 export { canStartUatTrainReconciler, getUatCandidatePayload, getUatGenerationsPayload, postUatGenerationPromotePayload, postUatGenerationStackPayload, resolveUatProjectRoot, runUatTrainReconcile, runUatTrainReconcileAllProjects, startUatTrainReconciler, stopUatTrainReconciler };

package/sync-sources/skills/pan-release/SKILL.md

@@ -34,20 +34,39 @@ Do not recommend GitFlow or a long-lived `develop` branch unless the user explic
 
 ## Preferred operator flow
 
-1. Run:
+Every stable release updates the public changelog and ends with a clean-install
+check. Neither step is optional.
+
+1. **Update the changelog first.** Add a `<Update label="vX.Y.Z" description="YYYY-MM-DD">`
+   block at the top of `changelog.mdx` with the user-facing changes since the
+   previous tag and a compare link to the new tag. Commit it as
+   `docs(infra): changelog for vX.Y.Z` and push `main`. `pan release` does not
+   edit the changelog, and it needs a clean tree. Details: `docs/RELEASING.md`,
+   "Update the public changelog".
+2. Run:
    ```bash
    pan release check
    ```
-2. Create a stable or canary release:
+3. Create a stable or canary release:
    ```bash
    pan release stable --version 0.7.1
    pan release canary --version 0.8.0-canary.1
    ```
-3. Push intentionally:
+4. Push intentionally:
    ```bash
    git push origin main
    git push origin v0.7.1
    ```
+5. **Verify a clean install after npm shows the new version.** Run the advertised
+   launch command with an empty cache and an empty global prefix, so a global
+   install on this machine can't hide a broken package:
+   ```bash
+   T=$(mktemp -d); cd "$T"
+   npm_config_prefix="$T/prefix" npx --yes --cache "$T/cache" @overdeck/core@X.Y.Z --version
+   ```
+   It must print `X.Y.Z`. If npm fails (for example `reading 'edgesOut'` or
+   `EUNSUPPORTEDPROTOCOL`), the release is broken for every new user: fix it and
+   ship a patch release the same day.
 
 ## What the CLI does
 
@@ -82,6 +101,10 @@ Prerequisites that must stay true or publishing breaks:
 - **No `workspace:*` in runtime `dependencies`** — bundled workspace packages
   (e.g. `@overdeck/contracts`) belong in `devDependencies`, or consumers'
   `npm install` fails with `EUNSUPPORTEDPROTOCOL`.
+- **No test frameworks in runtime `dependencies`** (`vitest`, `@effect/vitest`,
+  `@vitest/*`, `jest`, `@playwright/test`). 0.60.0–0.62.0 shipped `@effect/vitest`
+  there, and its peer graph crashed `npx @overdeck/core` with `reading 'edgesOut'`.
+  `scripts/lint-dist-externals.mjs` fails the build on this.
 - `publishConfig.access: "public"` on every publishable package.
 
 First-time setup for a brand-new package (npm org creation, the one-time