chore: skip native build scripts by default in allowBuilds

.changeset/cli-plugin-copilot_skip-agent-browser-install.md

@@ -0,0 +1,5 @@
+---
+"@equinor/fusion-framework-cli-plugin-copilot": patch
+---
+
+Internal: stop running `agent-browser`'s and `koffi`'s native-binary install scripts on every `pnpm install`. Both now build explicitly in this package's `prepack` script, so publishing still bundles the binaries but everyday installs no longer download them.

.github/actions/node-setup/action.yml

@@ -3,6 +3,9 @@ description: General setup of node
 inputs:
   node-version:
     default: 24
+  save-cache:
+    description: Whether to save the pnpm store cache on main (still restored either way)
+    default: 'true'
 
 runs:
   using: composite
@@ -47,7 +50,7 @@ runs:
     # Only main writes new cache entries — PRs restore-and-reuse but never
     # save, so open PRs stop each spawning their own throwaway ~700MB entry.
     - name: Save pnpm store
-      if: github.ref == 'refs/heads/main'
+      if: github.ref == 'refs/heads/main' && inputs.save-cache == 'true'
       uses: actions/cache/save@v4
       with:
         path: ${{ steps.pnpm-store.outputs.path }}

.github/workflows/ci.yml

@@ -101,6 +101,16 @@ jobs:
       - name: Setup node and install deps
         if: steps.check.outputs.should-publish == 'true'
         uses: ./.github/actions/node-setup
+        with:
+          save-cache: 'false'
+
+      # allowBuilds disables this by default (pnpm-workspace.yaml) since it's
+      # only needed here; vsce needs the native signing binary to publish.
+      # keytar isn't needed: --azure-credential uses OIDC, not the PAT/keytar
+      # credential store that `vsce login` would use.
+      - name: Build vsce-sign signing binary
+        if: steps.check.outputs.should-publish == 'true'
+        run: pnpm rebuild @vscode/vsce-sign
 
       # Build the extension and its workspace dependencies (lsp, rules, core)
       # in the correct order — vsce does not run the "prepack" build hook.

packages/cli-plugins/copilot/package.json

@@ -21,7 +21,7 @@
   "scripts": {
     "build": "tsc -b",
     "build:types": "tsc -b",
-    "prepack": "pnpm build"
+    "prepack": "pnpm rebuild agent-browser koffi && pnpm build"
   },
   "keywords": [
     "fusion-framework",

pnpm-workspace.yaml

@@ -47,15 +47,32 @@ overrides:
   zod: 4.4.3
 
 allowBuilds:
-  '@azure/msal-node-extensions': true
-  '@parcel/watcher': true
-  '@vscode/vsce-sign': true
-  agent-browser: true
-  esbuild: true
-  keytar: true
-  koffi: true
-  leveldown: true
-  msw: true
-  tree-sitter: true
-  tree-sitter-javascript: true
-  tree-sitter-typescript: true
+  # only used by AuthProviderInteractiveBrowser's OS-level token cache, a
+  # dynamic import with its own error message when unavailable — not hit by
+  # any CI workflow (they authenticate via OIDC, not interactive browser auth).
+  '@azure/msal-node-extensions': false
+  # only needed for `pnpm build:docs` (sass-embedded's file watcher); vuepress
+  # falls back to its default watcher without it.
+  '@parcel/watcher': false
+  # only needed to sign/package the fusion-lint vscode extension (rare, manual).
+  '@vscode/vsce-sign': false
+  # postinstall downloads a native binary from GitHub on every install; only the
+  # copilot cli-plugin needs it, so its own prepack rebuilds it explicitly instead.
+  agent-browser: false
+  # vite/vitest/tsc all build correctly without esbuild's own install script;
+  # the platform-specific @esbuild/* optional package supplies the binary.
+  esbuild: false
+  # native credential-cache addon for interactive local auth; not needed in CI
+  # or by default. Run `pnpm rebuild keytar` if you need it locally.
+  keytar: false
+  # native install script (@github/copilot-sdk's only dependent); rebuilt in that
+  # plugin's prepack instead of on every install.
+  koffi: false
+  # pouchdb/leveldown's native binding is already unavailable on macOS arm64
+  # regardless of this setting; not worth building on every install elsewhere.
+  leveldown: false
+  msw: false
+  # fusion-lint works fine without these; it doesn't require the native binding.
+  tree-sitter: false
+  tree-sitter-javascript: false
+  tree-sitter-typescript: false