Skip to content

fix: refresh pkg.pr.new @810 lockfile integrity - #78

Merged
ScriptedAlchemy merged 1 commit into
mainfrom
cursor/refresh-pkg-pr-new-integrity-7f83
Sep 16, 2026
Merged

fix: refresh pkg.pr.new @810 lockfile integrity#78
ScriptedAlchemy merged 1 commit into
mainfrom
cursor/refresh-pkg-pr-new-integrity-7f83

Conversation

@ScriptedAlchemy

@ScriptedAlchemy ScriptedAlchemy commented Sep 16, 2026 •
edited by cursor Bot
Loading

Copy link
Copy Markdown
Owner

Summary

Package CI npm ci fails with EINTEGRITY for the pkg.pr.new @810 preview packages after those tarballs were republished. Live @810 still resolves to the same URLs, but the bytes are now commit 19ab901 (last-modified 2026-09-16T22:00:58Z, x-commit-key ScriptedAlchemy:agent-bundle:19ab901221cb80ad83b917c7cdbf5eea4e3f3901), not the 5a4ae0a build recorded in the lockfile.

package-lock.json now matches the current tarballs:

  • agent-bundle@810 integrity sha512-31pzm7CnoFusDdKLLc5Aw1MS72VS/9edLBlxJhkT+9eOuSF6yTWbMODeZVR0oUsBGlNBZ/qa4EQNkXANJUqPow== (3811404 bytes)
  • @agent-bundle/runtime@810 integrity sha512-6zpWNTtkIy+yBhqcaWzEdTNqUFW5u3c7GiAOclVhInTopvRe5PZnj1PgWdcaNHKfWHTgFsMhWLYXoogUyC1g+Q==
  • Resolved URLs for those two packages stay @810
  • Runtime’s rewritten rsc-markdown-stream pin and the preview version (0.0.0-preview-19ab901) were updated so the lockfile matches the new tarball metadata

No product source changes. No changeset: .changeset/config.json changedFilePatterns does not include package-lock.json, and changeset status --since=origin/main reports nothing to bump.

This is the unblocker for Package CI on main (run 35159695338 after #76) and for #77, which will hit the same EINTEGRITY.

Test plan

  • npm ci succeeds against the updated lockfile (local Node 22.22 / npm 10.9.7)
  • Downloaded tarball sha512s match the lockfile integrity fields for both @810 packages and the rewritten rsc-markdown-stream pin
  • changeset status --since=origin/main passes without a new changeset
Open in Web Open in Cursor 

@cursoragent @ScriptedAlchemy
fix: refresh pkg.pr.new @810 lockfile integrity
04dff3b 
pkg.pr.new republished agent-bundle@810 and @agent-bundle/runtime@810
at commit 19ab901. Refresh integrity so npm ci no longer EINTEGRITY,
and follow the rewritten rsc-markdown-stream pin from the new tarballs.

Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
@changeset-bot

changeset-bot Bot commented Sep 16, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 04dff3b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@ScriptedAlchemy
ScriptedAlchemy marked this pull request as ready for review September 16, 2026 23:08
@ScriptedAlchemy
ScriptedAlchemy merged commit 479206b into main Sep 16, 2026
0 of 2 checks passed
@ScriptedAlchemy
ScriptedAlchemy deleted the cursor/refresh-pkg-pr-new-integrity-7f83 branch September 16, 2026 23:12
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 16, 2026

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-09-16T23:12:49.682351Z 04dff3b Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

cursor Bot pushed a commit that referenced this pull request Sep 16, 2026
@cursoragent @ScriptedAlchemy
Merge origin/main into fix/relay-headless-owner
c4e206c 
Bring in lockfile integrity refresh (#78), windows-latest CI (#76/#77),
and Release workflow_dispatch (#79) while keeping the relay keyring session isolation.

Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>
@ScriptedAlchemy ScriptedAlchemy mentioned this pull request Sep 16, 2026
Merged
ScriptedAlchemy added a commit that referenced this pull request Sep 17, 2026
@ScriptedAlchemy
fix: pin Agent Bundle previews to an immutable commit (#81)
27966e6 
Pin both compiler and runtime to the full 19ab901221cb80ad83b917c7cdbf5eea4e3f3901 commit that #78 already resolved. Package versions, integrity hashes and dependency graph stay identical.

Squash-merged under force-delivery: ACCEPT review; windows Package CI/Changeset starved ~37m with no runner (branch unprotected).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ScriptedAlchemy @cursoragent