build: align pnpm toolchain on 11.19

.github/workflows/node-ci.yml

@@ -91,7 +91,7 @@ jobs:
         if: steps.scope.outputs.check-markdown == 'true'
         uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
-          package_json_file: sdk/typescript/package.json
+          package_json_file: package.json
           cache: true
           cache_dependency_path: sdk/typescript/pnpm-lock.yaml
 
@@ -134,7 +134,7 @@ jobs:
       - name: Set up pnpm
         uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
-          package_json_file: sdk/typescript/package.json
+          package_json_file: package.json
           cache: true
           cache_dependency_path: |
             sdk/typescript/pnpm-lock.yaml
@@ -168,7 +168,7 @@ jobs:
       - name: Set up pnpm
         uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
-          package_json_file: sdk/typescript/package.json
+          package_json_file: package.json
           cache: true
           cache_dependency_path: |
             sdk/typescript/pnpm-lock.yaml
@@ -218,7 +218,7 @@ jobs:
       - name: Set up pnpm
         uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
-          package_json_file: sdk/typescript/package.json
+          package_json_file: package.json
           cache: true
           cache_dependency_path: |
             sdk/typescript/pnpm-lock.yaml
@@ -318,7 +318,7 @@ jobs:
       - name: Set up pnpm
         uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
-          package_json_file: plugins/codex-security/mcp-app/package.json
+          package_json_file: package.json
           cache: true
           cache_dependency_path: plugins/codex-security/mcp-app/pnpm-lock.yaml
       - name: Set up Node.js
@@ -442,7 +442,9 @@ jobs:
         with:
           node-version: "22.13.0"
       - name: Set up pnpm
-        run: npm install --global pnpm@11.9.0 --no-audit --no-fund
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with:
+          package_json_file: package.json
       - name: Set up Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:

.github/workflows/node-release.yml

@@ -74,7 +74,7 @@ jobs:
 
       - name: Enable pnpm
         shell: bash
-        run: corepack enable && corepack prepare "$(node -p 'require("./sdk/typescript/package.json").packageManager')" --activate
+        run: corepack enable && corepack prepare "$(node -p 'require("./package.json").packageManager')" --activate
 
       - name: Validate release tag
         id: release

.github/workflows/test-quality.yml

@@ -69,7 +69,7 @@ jobs:
       - name: Set up pnpm
         uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
-          package_json_file: sdk/typescript/package.json
+          package_json_file: package.json
           cache: true
           cache_dependency_path: |
             sdk/typescript/pnpm-lock.yaml
@@ -143,7 +143,7 @@ jobs:
           node-version: "22.13.0"
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
-          package_json_file: sdk/typescript/package.json
+          package_json_file: package.json
           cache: true
           cache_dependency_path: sdk/typescript/pnpm-lock.yaml
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2

.ona/automations.yml

@@ -2,7 +2,8 @@ tasks:
   install:
     name: Install dependencies
     command: |
-      npm install --global pnpm@11.9.0 bun@1.3.14 --no-audit --no-fund
+      pnpm_package="$(node -p 'require("./package.json").packageManager.split("+")[0]')"
+      npm install --global "$pnpm_package" bun@1.3.14 --no-audit --no-fund
       if ! command -v rg >/dev/null 2>&1; then
         sudo apt-get update \
           -o Dir::Etc::sourcelist=/etc/apt/sources.list.d/ubuntu.sources \

Dockerfile

@@ -8,11 +8,12 @@ RUN apt-get update \
 
 WORKDIR /build/sdk/typescript
 
+COPY package.json /build/package.json
 COPY sdk/typescript/package.json sdk/typescript/pnpm-lock.yaml sdk/typescript/pnpm-workspace.yaml ./
 COPY plugins/codex-security/mcp-app/package.json plugins/codex-security/mcp-app/pnpm-lock.yaml plugins/codex-security/mcp-app/pnpm-workspace.yaml /build/plugins/codex-security/mcp-app/
 
 RUN corepack enable \
-    && corepack prepare "$(node --print 'require("./package.json").packageManager')" --activate \
+    && corepack prepare "$(node --print 'require("/build/package.json").packageManager')" --activate \
     && pnpm install --frozen-lockfile \
     && pnpm --dir /build/plugins/codex-security/mcp-app install --frozen-lockfile
 

package.json

@@ -0,0 +1,4 @@
+{
+  "private": true,
+  "packageManager": "pnpm@11.19.0+sha512.7881f3ed590d472c4a955e2b88b2121791116066dcc88cbca3849ec9b60f1bbaa6d2ccb221fa91da4e1c65bef2bcbe379365aea7ac539c7bf86dedc3a1b22dce"
+}

plugins/codex-security/mcp-app/package.json

@@ -3,7 +3,6 @@
   "version": "0.1.158",
   "type": "module",
   "private": true,
-  "packageManager": "pnpm@11.9.0+sha512.bd682d5d03fe525ef7c9fd6780c6884d1e756ac4c9c9fe00c538782824310dcf90e3ddc4f53835f06dfaebd5085e41855e0bcbb3b60de2ac5bbab89e5036f03b",
   "scripts": {
     "build": "tsc --noEmit",
     "build:mcp": "node scripts/build_mcp_app.mjs --output .preview/mcp",

plugins/codex-security/mcp-app/pnpm-workspace.yaml

@@ -1,2 +1,3 @@
 allowBuilds:
   esbuild: false
+minimumReleaseAge: 10080

sdk/typescript/package.json

@@ -15,7 +15,6 @@
   "engines": {
     "node": "^22.13.0 || ^24.0.0 || ^26.0.0"
   },
-  "packageManager": "pnpm@11.9.0+sha512.bd682d5d03fe525ef7c9fd6780c6884d1e756ac4c9c9fe00c538782824310dcf90e3ddc4f53835f06dfaebd5085e41855e0bcbb3b60de2ac5bbab89e5036f03b",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {