fix: approve git installs with pnpm repo-level allowBuilds

pnpm 11 no longer accepts package-name-only allowBuilds for github: deps; write the stable git+https key and strip auto-placeholders so one-click install works. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-14 19:08:44 +08:00
parent ef0e7f34e3
commit f433cce24d
5 changed files with 114 additions and 34 deletions
@@ -74,13 +74,20 @@ function Get-UserEnv([string] $Name) {
  return [Environment]::GetEnvironmentVariable($Name, 'Process')
 }

+# pnpm 10+/11: package-name alone does NOT approve git/tarball installs.
+# Need the stable repo key (works across commits). See: https://pnpm.io/settings/build
+function Get-AllowBuildsEntries {
+  return @(
+    '  dsh-telegram-channel: true'
+    "  'dsh-telegram-channel@git+https://github.com/hi-wenw/dsh-telegram-channel.git': true"
+  )
+}
+
 function Ensure-AllowBuilds([string] $ProfileDir) {
  $path = Join-Path $ProfileDir 'pnpm-workspace.yaml'
-  $blockLines = @(
-    'allowBuilds:'
-    '  dsh-telegram-channel: true'
-  )
-  $block = $blockLines -join "`r`n"
+  $entries = Get-AllowBuildsEntries
+  $block = (@('allowBuilds:') + $entries) -join "`r`n"
+
  if (-not (Test-Path -LiteralPath $path)) {
    $content = @(
      'packages:'
@@ -97,18 +104,31 @@ function Ensure-AllowBuilds([string] $ProfileDir) {
  }

  $raw = Get-Content -LiteralPath $path -Raw
-  if ($raw -match '(?m)^\s*dsh-telegram-channel\s*:\s*true\s*$') {
-    Write-Host 'allowBuilds already present, skip'
+  # Drop pnpm auto-placeholders ("set this to true or false") for this package.
+  $raw = [regex]::Replace(
+    $raw,
+    '(?m)^\s*[''"]?dsh-telegram-channel@https://codeload\.github\.com/[^\r\n]+:\s*set this to true or false\s*\r?\n?',
+    ''
+  )
+
+  $repoKeyPresent = $raw -match 'dsh-telegram-channel@git\+https://github\.com/hi-wenw/dsh-telegram-channel\.git'
+  $nameKeyPresent = $raw -match '(?m)^\s*dsh-telegram-channel\s*:\s*true\s*$'
+  if ($repoKeyPresent -and $nameKeyPresent) {
+    Write-Host 'allowBuilds already present (git repo + package name), skip'
    return
  }

+  $toInsert = @()
+  if (-not $nameKeyPresent) { $toInsert += '  dsh-telegram-channel: true' }
+  if (-not $repoKeyPresent) {
+    $toInsert += "  'dsh-telegram-channel@git+https://github.com/hi-wenw/dsh-telegram-channel.git': true"
+  }
+  $insertText = ($toInsert -join "`r`n")
+
  if ($raw -match '(?m)^allowBuilds\s*:') {
-    if ($raw -notmatch '(?m)^allowBuilds\s*:[\s\S]*?dsh-telegram-channel\s*:') {
-      $raw = $raw -replace '(?m)^(allowBuilds\s*:)', ('$1' + "`r`n  dsh-telegram-channel: true")
-      $out = ($raw.TrimEnd() + "`r`n")
-      Set-Content -LiteralPath $path -Value $out -Encoding utf8
-      Write-Host ("Wrote allowBuilds.dsh-telegram-channel -> " + $path)
-    }
+    $raw = $raw -replace '(?m)^(allowBuilds\s*:)', ('$1' + "`r`n" + $insertText)
+    Set-Content -LiteralPath $path -Value ($raw.TrimEnd() + "`r`n") -Encoding utf8
+    Write-Host ("Updated allowBuilds (git repo approval) -> " + $path)
    return
  }

@@ -58,6 +58,7 @@ persist_env() {
  done
 }

+# pnpm 10+/11: package-name alone does NOT approve git/tarball installs.
 ensure_allow_builds() {
  local ws="$1/pnpm-workspace.yaml"
  if [[ ! -f "$ws" ]]; then
@@ -70,13 +71,54 @@ autoInstallPeers: false

 allowBuilds:
  dsh-telegram-channel: true
+  'dsh-telegram-channel@git+https://github.com/hi-wenw/dsh-telegram-channel.git': true
 EOF
-  elif ! grep -q 'dsh-telegram-channel:' "$ws"; then
-    if grep -q '^allowBuilds:' "$ws"; then
-      awk 'BEGIN{done=0} /^allowBuilds:/{print; print "  dsh-telegram-channel: true"; done=1; next} {print} END{if(!done){print ""; print "allowBuilds:"; print "  dsh-telegram-channel: true"}}' "$ws" >"$ws.tmp" && mv "$ws.tmp" "$ws"
-    else
-      printf '\nallowBuilds:\n  dsh-telegram-channel: true\n' >>"$ws"
-    fi
+    echo "Created $ws (allowBuilds)"
+    return
+  fi
+
+  # Drop pnpm auto-placeholders for this package.
+  if grep -q 'dsh-telegram-channel@https://codeload.github.com' "$ws" 2>/dev/null; then
+    tmp="$(mktemp)"
+    grep -v 'dsh-telegram-channel@https://codeload.github.com.*set this to true or false' "$ws" >"$tmp" || true
+    mv "$tmp" "$ws"
+  fi
+
+  local need_name=0 need_repo=0
+  grep -qE '^[[:space:]]*dsh-telegram-channel:[[:space:]]*true[[:space:]]*$' "$ws" || need_name=1
+  grep -q 'dsh-telegram-channel@git+https://github.com/hi-wenw/dsh-telegram-channel.git' "$ws" || need_repo=1
+  if [[ "$need_name" -eq 0 && "$need_repo" -eq 0 ]]; then
+    echo "allowBuilds already present (git repo + package name), skip"
+    return
+  fi
+
+  local insert=""
+  [[ "$need_name" -eq 1 ]] && insert+=$'  dsh-telegram-channel: true\n'
+  [[ "$need_repo" -eq 1 ]] && insert+=$'  '\''dsh-telegram-channel@git+https://github.com/hi-wenw/dsh-telegram-channel.git'\'': true\n'
+
+  if grep -q '^allowBuilds:' "$ws"; then
+    tmp="$(mktemp)"
+    awk -v insert="$insert" '
+      BEGIN { done=0 }
+      /^allowBuilds:/ {
+        print
+        printf "%s", insert
+        done=1
+        next
+      }
+      { print }
+      END {
+        if (!done) {
+          print ""
+          print "allowBuilds:"
+          printf "%s", insert
+        }
+      }
+    ' "$ws" >"$tmp" && mv "$tmp" "$ws"
+    echo "Updated allowBuilds (git repo approval) -> $ws"
+  else
+    printf '\nallowBuilds:\n%s' "$insert" >>"$ws"
+    echo "Appended allowBuilds -> $ws"
  fi
 }

@@ -71,13 +71,19 @@ function Get-UserEnv([string] $Name) {
  return [Environment]::GetEnvironmentVariable($Name, 'Process')
 }

+# pnpm 10+/11: package-name alone does NOT approve git/tarball installs.
+function Get-AllowBuildsEntries {
+  return @(
+    '  dsh-telegram-channel: true'
+    "  'dsh-telegram-channel@git+https://github.com/hi-wenw/dsh-telegram-channel.git': true"
+  )
+}
+
 function Ensure-AllowBuilds([string] $ProfileDir) {
  $path = Join-Path $ProfileDir 'pnpm-workspace.yaml'
-  $blockLines = @(
-    'allowBuilds:'
-    '  dsh-telegram-channel: true'
-  )
-  $block = $blockLines -join "`r`n"
+  $entries = Get-AllowBuildsEntries
+  $block = (@('allowBuilds:') + $entries) -join "`r`n"
+
  if (-not (Test-Path -LiteralPath $path)) {
    $content = @(
      'packages:'
@@ -94,18 +100,30 @@ function Ensure-AllowBuilds([string] $ProfileDir) {
  }

  $raw = Get-Content -LiteralPath $path -Raw
-  if ($raw -match '(?m)^\s*dsh-telegram-channel\s*:\s*true\s*$') {
-    Write-Host 'allowBuilds already present, skip'
+  $raw = [regex]::Replace(
+    $raw,
+    '(?m)^\s*[''"]?dsh-telegram-channel@https://codeload\.github\.com/[^\r\n]+:\s*set this to true or false\s*\r?\n?',
+    ''
+  )
+
+  $repoKeyPresent = $raw -match 'dsh-telegram-channel@git\+https://github\.com/hi-wenw/dsh-telegram-channel\.git'
+  $nameKeyPresent = $raw -match '(?m)^\s*dsh-telegram-channel\s*:\s*true\s*$'
+  if ($repoKeyPresent -and $nameKeyPresent) {
+    Write-Host 'allowBuilds already present (git repo + package name), skip'
    return
  }

+  $toInsert = @()
+  if (-not $nameKeyPresent) { $toInsert += '  dsh-telegram-channel: true' }
+  if (-not $repoKeyPresent) {
+    $toInsert += "  'dsh-telegram-channel@git+https://github.com/hi-wenw/dsh-telegram-channel.git': true"
+  }
+  $insertText = ($toInsert -join "`r`n")
+
  if ($raw -match '(?m)^allowBuilds\s*:') {
-    if ($raw -notmatch '(?m)^allowBuilds\s*:[\s\S]*?dsh-telegram-channel\s*:') {
-      $raw = $raw -replace '(?m)^(allowBuilds\s*:)', ('$1' + "`r`n  dsh-telegram-channel: true")
-      $out = ($raw.TrimEnd() + "`r`n")
-      Set-Content -LiteralPath $path -Value $out -Encoding utf8
-      Write-Host ("Wrote allowBuilds.dsh-telegram-channel -> " + $path)
-    }
+    $raw = $raw -replace '(?m)^(allowBuilds\s*:)', ('$1' + "`r`n" + $insertText)
+    Set-Content -LiteralPath $path -Value ($raw.TrimEnd() + "`r`n") -Encoding utf8
+    Write-Host ("Updated allowBuilds (git repo approval) -> " + $path)
    return
  }