fix(agent-think): pin Workspace preview to immutable commit - #2001
Merged
Conversation
The `@cloudflare/workspace` dependency pointed at `pkg.pr.new/.../@cloudflare/workspace@18`, where `@18` is a mutable PR alias rather than a version. Workspace PR #18 published a new build (92c4478) at 08:20 UTC, repointing that alias, so the tarball no longer matched the integrity recorded in the lockfile and every cold `pnpm install --frozen-lockfile` failed with ERR_PNPM_TARBALL_INTEGRITY. Runs with a warm pnpm store never refetched the tarball, so the drift only surfaced once a lockfile change invalidated the setup-node cache key. Pin the specifier to commit 98b74eb — the build whose hash is already in the lockfile, and the same commit the wsd image is pinned to in the Dockerfile (`pr-18-98b74eb`), so host and daemon stay in sync. The recorded integrity is unchanged. Follow-up: PR #18 is now merged, but no Workspace release has been cut (newest npm prerelease is 0.0.0-alpha.12 from 2026-07-06, and the release workflow only triggers on `v*` tags). Once a release exists, replace this URL with a plain version and repin the Dockerfile image.
|
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
agents
@cloudflare/ai-chat
@cloudflare/codemode
create-think
hono-agents
@cloudflare/shell
@cloudflare/think
@cloudflare/voice
@cloudflare/worker-bundler
commit: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
agent-thinkhas a dependency on@cloudflare/workspace.The version referenced in the package.json was
pkg.pr.new/.../@cloudflare/workspace@18which is a PR alias.Workspace PR 18 published a new build (92c4478) this morning, repointing that alias, so the tarball no longer matched the integrity recorded in the lockfile and every cold
pnpm install --frozen-lockfilefailed with ERR_PNPM_TARBALL_INTEGRITY.What
Pins the specifier to commit 98b74eb — the build whose hash is already in the lockfile, and the same commit the
wsdimage is pinned to in the Dockerfile (pr-18-98b74eb), so host and daemon stay in sync. The recorded integrity is unchanged.Follow-up: PR #18 is now merged, but no Workspace release has been cut (newest npm prerelease is 0.0.0-alpha.12 from 2026-07-06, and the release workflow only triggers on
v*tags). Once a release exists, replace this URL with a plain version and repin the Dockerfile image.