chore(effect): bump published provider/sandbox pins to 0.4.19/0.4.22 - #228
Conversation
Follow #223: update only the private Effect package’s published Coder pins, exact release-age exceptions, lockfile, and pinned-version documentation. Signed-off-by: Thomas Kosiewski <tk@coder.com> --- _Generated with [`xum`](https://github.com/coder/xum) • Model: `coder:openai/gpt-6-astra` • Thinking: `high`_ Change-Id: I76cfc43ab81065fabd46659bbcc87ee1af93a29c
|
@codex review |
|
@codex security review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Validation evidenceNode 26.9.0: all local gates passed, 640 unit tests passed, and live e2e passed 7/7. The uncached frozen install verified 456 policy entries. Both live attempts passed; no further attempts were run. The screenshot and 12-second video are completion evidence. The video is an accelerated agent-tty replay of the recorded terminal session, not real-time footage. Per-command full logs and the original asciicast are retained outside the checkout. The capture preserves one harness setup error: the explicit Node PATH omitted the Coder shim (
validation.webmGenerated with |
|
Codex Review: Didn't find any major issues. You're on a roll. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
1 participant
Summary
Follow #223's exact four-file shape for the private, unpublished Effect spike:
@coder/ai-sdk-providerto0.4.19and@coder/ai-sdk-sandboxto0.4.22.pnpm install.@ai-sdk/providerat4.0.17. The published provider's npm metadata requires that version. No peer-range, other-package, or changelog changes.The fresh own-package release-age exceptions are explicitly authorized. Effect remains outside release-please.
Validation
mise install; Node26.9.0, pnpm11.27.0.pnpm install;pnpm format.node_modules, then ranCI=true pnpm_config_cache_dir=<new-empty-directory> pnpm install --frozen-lockfile. All 456 policy entries verified; a freshlockfile-verified.jsonlwas written.pnpm check,pnpm -r build,pnpm -r test(640 passed),pnpm publint, andpnpm attwpassed.grep -c '@ai-sdk/provider@' pnpm-lock.yamlis 2.pnpm why @ai-sdk/providerand recursive workspace inspection confirm one version: 4.0.17.coder whoami, thencd packages/agent && npx vitest run test/e2eagainst dogfood using ambient credentials: 7/7 passed on both permitted attempts. The second pass qualified the explicitly pinned Node path after nested pnpm initially selected Node 22. No tests or assertions were changed.Verification tiers: package dependency metadata verified against npm; private/release exclusion verified against source; agent behavior verified live against dogfood.
Generated with
xum• Model:coder:openai/gpt-6-astra• Thinking:high