[BigDataDZ]

Problem and result

The source installer accepts pnpm 9 or newer, but pnpm 12 ignores package.json#pnpm.overrides. Its frozen install therefore rejects the committed lockfile with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH before plugin installation (#6853).

Register the existing package in its workspace and project the same existing fflate override into pnpm-workspace.yaml. Keep the package.json projection because pnpm 9 still reads it. The resolved dependency graph, override version and existing five build-script denials stay unchanged. Add a lightweight pnpm 9.15.9 / 10.33.0 / 12.10.1 frozen-configuration matrix; retain the existing full Ubuntu/Windows distribution jobs.

Validation

• Reproduced the pnpm 12 frozen mismatch on unchanged main; the corrected configuration passes frozen lockfile-only installation on all three declared matrix versions without changing lockfile contents.
• Negative checks in disposable copies: drifting the package.json override on pnpm 9, or the workspace override on pnpm 12, is rejected with the original mismatch error.
• Actual pnpm 12 full frozen dependency installation passes with dependency scripts disabled. The real source installer then builds/packs and installs into a disposable web profile; its built-in ordered four-row validation passes. Independent readback confirms the installed package version, and real removal clears every row.
• Full source-installer completion on Windows remains failed: the subsequent existing version verifier passes a multiline node -e argument through DSH/execa, which Windows rejects. This later failure is outside frozen configuration; it is preserved and will be repaired separately. An earlier concurrent installation attempt was invalidated and rerun serially; it is not counted as acceptance.
• Independent diff review found no additional blocker. The related refactor pass retained the necessary compatibility projection rather than adding a new configuration owner; the frozen matrix checks its agreement with the existing lock.

No dependency upgrade, global tool upgrade, benchmark run or package publication is included. Hosted CI and maintainer review remain required.

Closes #6853.

[BigDataDZ]

CI readback for exact head 250f8be6ad020d2b063b474cf585d0cb17c680b4:

• All new frozen-configuration jobs passed: pnpm 9.15.9, 10.33.0 and 12.10.1. Existing full plugin distribution jobs also passed on Ubuntu and Windows (distribution run).
• The separate Windows boundary job failed in three unchanged long-path brief-budget tests: JSON length 10522 exceeds 10500 (3 failed, 6 passed, 179 deselected). Later native checks in that job were skipped. This PR changes only plugin workspace configuration and its distribution workflow; it does not edit that emitter, budget or tests. The existing repair is tracked in test(ci): qualify brief JSON budgets across native path depths #6843. No base replay was performed for this CI readback.
• Full Windows source-installer completion, including the separately discovered multiline version-verifier failure, is proposed and locally qualified in fix(dsh): finish Windows source installation with verified version #6862; it is not claimed as fixed by this configuration-only PR.

Remaining workflow jobs and maintainer review are pending; this is evidence followthrough, not an approval or merge-readiness assertion.

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · reasoning_effort=max

Exact head: 250f8be6ad020d2b063b474cf585d0cb17c680b4 · merge base: 4f6e20a13b090318e14efeb20b91790e33fe694b

动机

从源码安装 DSH 插件的用户已经通过 pnpm 版本检查，却会在冻结依赖安装时被拒绝，无法继续构建和安装。pnpm 12 不再读取 package.json 中的 override，而锁文件仍要求原来的 fflate 0.8.3；pnpm 9 还要求工作区声明 packages。

本次恢复这条已承诺的安装入口：让不同版本读取同一个既有依赖约束，并让配置漂移继续失败。独立三版本对照和真实 pnpm 12 源安装、版本读回、不兼容宿主拒绝及卸载均通过。

范围是冻结配置和回归矩阵，不包括依赖升级、全局工具升级、包发布或修复另一个 Windows 版本核验问题。该问题沿用 #6862 的独立边界，不影响本次已验证的配置修复。

改动思路

保留既有 package.json override 供 pnpm 9 读取，并在现有 workspace 文件投影同一个 0.8.3；冻结锁文件与三版本矩阵约束两处一致，五个 build-script denials 保持。

当前 PR 应交付三版本真实冻结安装的配置兼容及漂移拒绝，继续使用原构建、profile 读回和卸载入口；不增加另一套安装器或用户设置。

这两份配置是独立版本工具所需的兼容投影：只留 package.json 会重现 pnpm 12 拒绝，只留 workspace 会破坏 pnpm 9 的既有读取。脚本生成器、重写锁文件、移除 override 或临时取消冻结检查都增加成本或降低原保护，当前没有必要。新增 job 只做冻结配置与 lock diff 检查，原 Ubuntu/Windows 完整 distribution jobs 保留，因此没有用轻量矩阵替代完整分发验收。

具体改动

完整 diff 为两个文件 +32/-0：workspace 增加自身 package 与既有 override，workflow 增加 9.15.9、10.33.0、12.10.1 的配置检查。package.json、pnpm-lock.yaml、源码安装器、插件源码和五项构建脚本拒绝值均未改。

关键代码讲解

• packages 与 overrides 显式只包含当前包，并为新 reader 提供原来的 fflate 0.8.3。它不扩大到其他目录或升级依赖。
• frozen-configuration 实际运行三个工具版本的 frozen/lockfile-only/ignore-scripts，再检查锁文件没有变化；fail-fast=false 保留每个版本的结果。
• 既有 install.sh 是真实消费者：完整冻结安装后构建打包，添加到 web profile，再核验四项条目和安装版本。它没有因这次修复绕过版本检查或授予启动模型的权限。

验收依据为 #6853 的 Expected outcome，spec_revision=issue-6853-body-1165441828abceab505c22b0889754ba7f6997737aacd4a774cd0670dc9bd5c8。这是本轮读取的公开 issue 正文指纹。

criterion_id	处置与独立证据
Expected outcome	implemented：保留 override 和冻结语义；资格化支持版本的配置投影；不重生成锁、不移除约束；真实源码依赖命令及原有后续安装入口均执行

实际同脚本对照使用不可变 base/head 的三份配置文件，完整命令为 pnpm install --frozen-lockfile --lockfile-only --ignore-scripts：

pnpm	基线	当前 head
9.15.9	packages field missing or empty	通过
10.33.0	通过	通过
12.10.1	ERR_PNPM_LOCKFILE_CONFIG_MISMATCH	通过

另两项反例：只把 package.json 的值改成 0.8.2，pnpm 9 拒绝；只把 workspace 的值改成 0.8.2，pnpm 12 拒绝。八项执行的三个输入文件哈希前后均不变。最初以为基线 9 可通过的私有 oracle 被实际错误推翻，保留该失败后改成记录真实基线，未改变产品或削弱冻结规则。

对主干的风险

主要维护风险是兼容投影未来不同步。实际负例证明原 frozen lock 会拒绝两边各自的漂移，新增矩阵保护的是具体 reader 差异，保留两份值的成本有依据。这里没有新的业务状态、权限、默认启用策略或 agent 指令。

独立实际 pnpm 12 完整源码安装通过：真实依赖安装、构建/pack、web profile 添加、四条有序配置及安装版本读回；原不兼容宿主负例拒绝在 profile 效果前；最后卸载并读回条目消失。没有触碰个人 profile、启动真实用户会话或发送模型请求。当前源 premerge 4 direct +7 selected 全部通过，包括原 DSH quality、package、runtime 三阶段；真实 DSH/打包 Client 的测试仍有合成 CLI/session 边界，不能当成 live 模型使用证明。

验证历史保持透明：一次 pnpm 12 线上 lockfile-only 在 180 秒超时，内部原因未确定；同配置离线检查和随后原线上命令通过，之后完整实际安装也通过，不据此认证冷网络尾延迟。另一次 profile ENOEXEC 来自我隔离准备的 pnpm 未执行自身 native 安装步骤：其启动器当时为无 shebang 的占位文件。按该工具自带流程补齐原生启动器后，同一产品 smoke 通过；原失败和独立诊断保留，产品代码没有修改。

语义与 CI 对齐

这是 pnpm 外部配置格式的兼容投影，复用既有依赖约束；没有新建 LoopX 控制面词汇。ignore-scripts 与五项拒绝不是建议，而是继续保留的执行限制。新增本地三版本证据不代表 hosted job 已通过；本轮按当前配置不查询、轮询、等待或派发 CI。

我的整体评价

APPROVE。problem_context=goal_achieved 仅针对 #6853 的配置修复；user_experience=improved，long_horizon=preserved：安装者可越过原错误，漂移仍拒绝，后续构建、读回和清理沿用原 owner。八项基线/当前对照、实际完整安装与原生风险检查支持这一有界结论。

必要的兼容投影应保留，当前无需再抽象配置 owner。Windows 后续版本核验、未来未测试 pnpm 版本及冷网络成本分别保留边界，不把本次批准扩成全平台、发布或 merge 资格。

English verdict: APPROVE at 250f8be. Actual pnpm 9/10/12 frozen checks and two projection-drift negatives preserve the lock bytes; pnpm 12 source installation, installed-version/profile readback, incompatible-host rejection and removal pass. Current source premerge passes 4 direct and 7 selected checks. Earlier tool-setup and timeout observations are retained; Windows follow-up, live-model use and cold-network performance are outside this bounded qualification.