From a0dd97df672a26e52cef9d88f38d4b9211ddeff5 Mon Sep 17 00:00:00 2001 From: Fielding Johnston Date: Sun, 26 Jul 2026 23:42:58 -0500 Subject: [PATCH] fix: stop shadowing the repo pnpm lockfile on Vercel All three Vercel projects set rootDirectory to a package (ripguard and ripguard-testnet -> packages/app, ripguard-sol -> packages/app-sol), so `pnpm install` runs inside the package directory. pnpm resolves its workspace root to the nearest pnpm-workspace.yaml, which was the one in the package itself -- so the repo-root pnpm-lock.yaml was never used and every dependency was re-resolved from its semver range at deploy time. That drift is what broke ripguard.xyz: fresh resolution now yields rainbowkit 2.2.11 -> @wagmi/connectors 6.2.0 -> @base-org/account 2.4.0 -> @coinbase/cdp-sdk 1.54.0, whose x402 module dynamically imports the @x402/* optional peer dependencies. They are legitimately absent, and Turbopack turns the unresolvable specifiers into build errors. The lockfile pins @coinbase/cdp-sdk 1.45.0, which has no such import, so CI and local builds stayed green. packages/app-sol carried the identical marker. It builds today only because its tree has not yet drawn a broken upstream release, so remove both rather than leave the second one armed. Removing the nested markers lets pnpm find the root workspace and lockfile from either package, making both deploys reproducible and identical to CI. The ignoredBuiltDependencies they carried were the same two entries and move to the root pnpm-workspace.yaml. Co-Authored-By: Claude Opus 5 --- AGENTS.md | 33 ++++++++++++++++++++++++++++ CLAUDE.md | 1 + packages/app-sol/pnpm-workspace.yaml | 3 --- packages/app/pnpm-workspace.yaml | 3 --- pnpm-workspace.yaml | 4 ++++ 5 files changed, 38 insertions(+), 6 deletions(-) create mode 100644 AGENTS.md create mode 120000 CLAUDE.md delete mode 100644 packages/app-sol/pnpm-workspace.yaml delete mode 100644 packages/app/pnpm-workspace.yaml diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 0000000..dcb1a49 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,33 @@ +# Project agent memory + +This file is the project's committed home for project-intrinsic agent knowledge: build, test, release, architecture, and sharp-edge notes that should travel with the code. + +- Add durable project-specific notes here as they are discovered through real work. + +## Vercel deploys and the pnpm workspace root + +Every Vercel project sets `rootDirectory` to a package (`ripguard` and +`ripguard-testnet` -> `packages/app`, `ripguard-sol` -> `packages/app-sol`) with +"include source files outside the root directory" on. Vercel therefore runs +`pnpm install` *inside* the package directory, not at the repo root. + +pnpm picks the **nearest** `pnpm-workspace.yaml` walking up from the cwd. A +`pnpm-workspace.yaml` inside `packages//` makes that package its own workspace +root, so the repo-root `pnpm-lock.yaml` is ignored and every dependency is re-resolved +from its semver range at deploy time. Production then drifts away from CI and from +local, and an unrelated upstream release can break the build weeks after the last +green deploy — which is exactly what took ripguard.xyz down. Both nested files have +been removed; keep pnpm settings (`ignoredBuiltDependencies`, overrides) in the root +`pnpm-workspace.yaml` / root `package.json` only, and do not reintroduce a +`pnpm-workspace.yaml` under `packages/`. + +Verify a deploy the way Vercel does, not the way CI does: +`cd packages/ && CI=1 pnpm install && ./node_modules/.bin/next build`. +A green `pnpm install --frozen-lockfile` at the repo root does not exercise this path. + +## Maintaining this file + +Keep this file for knowledge useful to almost every future agent session in this project. +Do not repeat what the codebase already shows; point to the authoritative file or command instead. +Prefer rewriting or pruning existing entries over appending new ones. +When updating this file, preserve this bar for all agents and keep entries concise. diff --git a/CLAUDE.md b/CLAUDE.md new file mode 120000 index 0000000..47dc3e3 --- /dev/null +++ b/CLAUDE.md @@ -0,0 +1 @@ +AGENTS.md \ No newline at end of file diff --git a/packages/app-sol/pnpm-workspace.yaml b/packages/app-sol/pnpm-workspace.yaml deleted file mode 100644 index 581a9d5..0000000 --- a/packages/app-sol/pnpm-workspace.yaml +++ /dev/null @@ -1,3 +0,0 @@ -ignoredBuiltDependencies: - - sharp - - unrs-resolver diff --git a/packages/app/pnpm-workspace.yaml b/packages/app/pnpm-workspace.yaml deleted file mode 100644 index 581a9d5..0000000 --- a/packages/app/pnpm-workspace.yaml +++ /dev/null @@ -1,3 +0,0 @@ -ignoredBuiltDependencies: - - sharp - - unrs-resolver diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index dee51e9..f95d20a 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -1,2 +1,6 @@ packages: - "packages/*" + +ignoredBuiltDependencies: + - sharp + - unrs-resolver