[annikaschmid]

Summary

• raise the pnpm workspace minimum release age to 7 days
• require pnpm install so npm cannot bypass the workspace age policy or its exclusions

Testing

• pnpm config get minimumReleaseAge
• npm_config_user_agent="pnpm/10.23.0 npm/? node/v22.0.0 darwin x64" node scripts/enforce-pnpm.mjs
• npm_config_user_agent="npm/11.0.0 node/v22.0.0 darwin x64" node scripts/enforce-pnpm.mjs

[greptile-apps]

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
.npmrc:3
**`minimumReleaseAgeExclude` not honoured by npm**

`pnpm-workspace.yaml` defines a `minimumReleaseAgeExclude` list (e.g. `@posthog/quill`, `@anthropic-ai/claude-agent-sdk`, `@agentclientprotocol/sdk`, `@posthog/quill-tokens`) so those packages can bypass the age gate. npm's implementation of `minimumReleaseAge` (added in CLI v11) does not yet support an exclusion list, so any developer running `npm install` directly will hit the 7-day block for those packages even though they are intentionally excluded under pnpm. This could break CI jobs or local installs that invoke npm instead of pnpm.

_{Reviews (1): Last reviewed commit: "chore: require 7-day package release age" | Re-trigger Greptile}

[greptile-apps]

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
pnpm-workspace.yaml:9
**npm guardrail missing from `.npmrc`**

The PR description states "add a matching npm minimum release age guardrail," but `.npmrc` only contains `node-linker=hoisted` and `shamefully-hoist=true` — no `minimumReleaseAge` entry was added. Any install performed with plain `npm` (e.g. some CI steps or contributors not using pnpm) will not be subject to the 7-day age gate, leaving the guardrail incomplete for those paths.

_{Reviews (2): Last reviewed commit: "fix: remove npm release age override" | Re-trigger Greptile}

[greptile-apps]

npm guardrail missing from .npmrc

The PR description states "add a matching npm minimum release age guardrail," but .npmrc only contains node-linker=hoisted and shamefully-hoist=true — no minimumReleaseAge entry was added. Any install performed with plain npm (e.g. some CI steps or contributors not using pnpm) will not be subject to the 7-day age gate, leaving the guardrail incomplete for those paths.

Prompt To Fix With AI

This is a comment left during a code review.
Path: pnpm-workspace.yaml
Line: 9

Comment:
**npm guardrail missing from `.npmrc`**

The PR description states "add a matching npm minimum release age guardrail," but `.npmrc` only contains `node-linker=hoisted` and `shamefully-hoist=true` — no `minimumReleaseAge` entry was added. Any install performed with plain `npm` (e.g. some CI steps or contributors not using pnpm) will not be subject to the 7-day age gate, leaving the guardrail incomplete for those paths.

How can I resolve this? If you propose a fix, please make it concise.

[annikaschmid]

Added a preinstall guard in package.json that fails plain npm install and requires pnpm install instead. That closes the npm bypass path without reintroducing an npm minimumReleaseAge setting that cannot honor minimumReleaseAgeExclude.

[greptile-apps]

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
scripts/enforce-pnpm.mjs:1-14
**`--ignore-scripts` bypasses this guard**

`npm install --ignore-scripts` (or `npm ci --ignore-scripts`) skips all lifecycle hooks, including `preinstall`, so the check never runs and a plain npm install silently proceeds without the 7-day age gate. Since the goal is to close the npm bypass path entirely, CI configs or contributors that habitually pass `--ignore-scripts` will still circumvent the policy.

_{Reviews (3): Last reviewed commit: "fix: require pnpm installs" | Re-trigger Greptile}

[annikaschmid]

Re: the --ignore-scripts note, I do not think this is a blocker for this PR. All documented and CI workspace install paths in this repo use pnpm install today, so the supported contributor and automation flows still pick up minimumReleaseAge plus minimumReleaseAgeExclude. npm --ignore-scripts is an explicit local opt-out of lifecycle enforcement rather than a normal repo path, and there are already a few intentional scoped npm install usages in nested/temp contexts that are separate from root workspace installation. So the goal of this change is to harden the supported workspace install path, not make deliberate local bypass impossible.