From 8ed1f51f75c025bf36b0b5d8d03d36675f8c6da2 Mon Sep 17 00:00:00 2001 From: Nicky Leach Date: Wed, 26 Aug 2026 10:42:13 -0700 Subject: [PATCH] fix(scripts): silence pnpm DEP0169 at provisioning install call sites (#12228) ## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work. > - Worktree provisioning prepares the dependencies and tools that these agents need. > - The pinned pnpm version calls the deprecated `url.parse()` function during each install. > - Node.js 24 reports this call as `DeprecationWarning [DEP0169]`. > - The provisioning scripts run more than one install, so the warning repeats in each run. > - This pull request disables only `DEP0169` at each affected pnpm install call site. > - The benefit is a clear provisioning log while other deprecation warnings remain visible. ## Linked Issues or Issue Description **What happened?** The worktree provisioning scripts printed `DeprecationWarning [DEP0169]` during each pnpm install. The warning came from pnpm 9.15.4 and its `toNerfDart` call to `url.parse()`. **Expected behavior** The provisioning scripts should hide this known warning from the pinned pnpm version. They should keep other deprecation warnings visible. **Steps to reproduce** 1. Use Node.js 24 with pnpm 9.15.4. 2. Run worktree provisioning with a base-workspace repair or dependency install. 3. Observe the repeated `DeprecationWarning [DEP0169]` output. **Paperclip version or commit** Commit `5cd41b1a9996713efdfdc62373da8045664c7f30`. **Deployment mode** Built from source. **Installation method** Built from source with pnpm. **Agent adapter(s) involved** Not adapter-specific (core bug). **Database mode** Not database-related. ## What Changed - Add `--disable-warning=DEP0169` to each affected pnpm install call site. - Append the flag to `NODE_OPTIONS` so the scripts keep existing values. - Add comments that name the source of the warning and the removal condition. - Add a regression test for all affected scripts and warning codes. ## Verification - `bash -n scripts/provision-worktree.sh` passes. - `bash -n scripts/provision-worktree-runtime.sh` passes. - `node --test scripts/__tests__/provision-worktree-self-heal.test.mjs` passes with 15 tests. - GitHub Actions must pass all required checks before merge. ## Risks This change has low risk. It changes warning output only for `DEP0169`. It does not overwrite existing `NODE_OPTIONS` values. Revert commit `5cd41b1a9996713efdfdc62373da8045664c7f30` to restore the prior output. ## Model Used OpenAI Codex, GPT-5. The model used tool calls and code execution. The runtime did not expose a context-window value. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes: #` / `Refs: #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] All Paperclip CI gates are green - [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge Co-authored-by: Paperclip --- .../provision-worktree-self-heal.test.mjs | 32 +++++++++++++++++++ scripts/provision-worktree-runtime.sh | 8 +++-- scripts/provision-worktree.sh | 13 ++++++-- 3 files changed, 48 insertions(+), 5 deletions(-) diff --git a/scripts/__tests__/provision-worktree-self-heal.test.mjs b/scripts/__tests__/provision-worktree-self-heal.test.mjs index bbe44698d1..c74c480b49 100644 --- a/scripts/__tests__/provision-worktree-self-heal.test.mjs +++ b/scripts/__tests__/provision-worktree-self-heal.test.mjs @@ -492,3 +492,35 @@ test("runtime provisioning does not trust a truncated verified manifest", () => 1, ); }); + +/** + * pnpm 9.15.4 calls the deprecated url.parse() once per `pnpm install` + * (see toNerfDart in the pnpm bundle), which Node 24 reports as DEP0169. + * Each `pnpm install` call site must silence that one warning code, and must + * append the flag to any NODE_OPTIONS value the environment already set + * instead of overwriting it. + */ +test("every pnpm install call site silences DEP0169 without overwriting NODE_OPTIONS", () => { + const disableWarningFlag = "--disable-warning=DEP0169"; + const appendsToExistingNodeOptions = /NODE_OPTIONS="\$\{NODE_OPTIONS:-\} --disable-warning=DEP0169"/; + + const provisionSource = fs.readFileSync(script, "utf8"); + const repairCallSites = provisionSource.match(/env -u NODE_ENV CI=true NODE_OPTIONS="\$repair_node_options" "\$\{repair_cmd\[@\]\}"/g) ?? []; + assert.equal(repairCallSites.length, 2, "expected the repair pnpm install to carry the flag at both call sites (locked and unlocked)"); + assert.match(provisionSource, /local repair_node_options="\$\{NODE_OPTIONS:-\} --disable-warning=DEP0169"/); + assert.match(provisionSource, appendsToExistingNodeOptions); + assert.match(provisionSource, /NODE_OPTIONS="\$\{NODE_OPTIONS:-\} --disable-warning=DEP0169" pnpm install --prod=false "\$@"/); + + const runtimeSource = fs.readFileSync(runtimeScript, "utf8"); + const runtimeRepairCallSites = runtimeSource.match(/env -u NODE_ENV CI=true NODE_OPTIONS="\$repair_node_options" "\$\{repair_cmd\[@\]\}"/g) ?? []; + assert.equal(runtimeRepairCallSites.length, 2, "expected the repair pnpm install to carry the flag at both call sites (locked and unlocked)"); + assert.match(runtimeSource, /local repair_node_options="\$\{NODE_OPTIONS:-\} --disable-warning=DEP0169"/); + + // No other warning code is suppressed anywhere in either script. + for (const source of [provisionSource, runtimeSource]) { + const disableWarningMatches = source.match(/--disable-warning=[^\s"]+/g) ?? []; + for (const match of disableWarningMatches) { + assert.equal(match, disableWarningFlag); + } + } +}); diff --git a/scripts/provision-worktree-runtime.sh b/scripts/provision-worktree-runtime.sh index a6d925918a..9303645481 100755 --- a/scripts/provision-worktree-runtime.sh +++ b/scripts/provision-worktree-runtime.sh @@ -106,6 +106,10 @@ repair_base_workspace_install() { [[ -f "$base_cwd/package.json" && -f "$base_cwd/pnpm-lock.yaml" ]] || return 1 echo "Base workspace CLI at $base_cli_entry_path failed its health check (typically dangling pnpm symlinks after a partial install); repairing with pnpm install in $base_cwd." >&2 local repair_cmd=(pnpm install --prod=false --force --frozen-lockfile --config.confirmModulesPurge=false) + # pnpm 9.15.4 calls the deprecated url.parse() in toNerfDart on every + # install. Node 24 reports that call as DEP0169. Remove this flag when the + # pinned pnpm no longer calls url.parse() in that path. + local repair_node_options="${NODE_OPTIONS:-} --disable-warning=DEP0169" local repair_lock_dir="" if command -v git >/dev/null 2>&1; then repair_lock_dir="$(git -C "$base_cwd" rev-parse --absolute-git-dir 2>/dev/null || true)" @@ -122,11 +126,11 @@ repair_base_workspace_install() { echo "Base workspace CLI became healthy while waiting for the repair lock; skipping reinstall." >&2 exit 0 fi - env -u NODE_ENV CI=true "${repair_cmd[@]}" >&2 || exit 1 + env -u NODE_ENV CI=true NODE_OPTIONS="$repair_node_options" "${repair_cmd[@]}" >&2 || exit 1 base_cli_healthy ) else - (cd "$base_cwd" && env -u NODE_ENV CI=true "${repair_cmd[@]}" >&2 && base_cli_healthy) + (cd "$base_cwd" && env -u NODE_ENV CI=true NODE_OPTIONS="$repair_node_options" "${repair_cmd[@]}" >&2 && base_cli_healthy) fi } diff --git a/scripts/provision-worktree.sh b/scripts/provision-worktree.sh index d25f6a6672..1f41b03082 100644 --- a/scripts/provision-worktree.sh +++ b/scripts/provision-worktree.sh @@ -91,6 +91,10 @@ repair_base_workspace_install() { # otherwise skip the dangling symlinks; --frozen-lockfile keeps the repair # from mutating the shared base workspace's lockfile. local repair_cmd=(pnpm install --prod=false --force --frozen-lockfile --config.confirmModulesPurge=false) + # pnpm 9.15.4 calls the deprecated url.parse() in toNerfDart on every + # install. Node 24 reports that call as DEP0169. Remove this flag when the + # pinned pnpm no longer calls url.parse() in that path. + local repair_node_options="${NODE_OPTIONS:-} --disable-warning=DEP0169" # Resolve the real git dir so locking also covers base workspaces that are # linked worktrees, where "$base_cwd/.git" is a file rather than a directory. local repair_lock_dir="" @@ -113,11 +117,11 @@ repair_base_workspace_install() { echo "Base workspace CLI became healthy while waiting for the repair lock; skipping reinstall." >&2 exit 0 fi - env -u NODE_ENV CI=true "${repair_cmd[@]}" >&2 || exit 1 + env -u NODE_ENV CI=true NODE_OPTIONS="$repair_node_options" "${repair_cmd[@]}" >&2 || exit 1 base_cli_healthy ) else - (cd "$base_cwd" && env -u NODE_ENV CI=true "${repair_cmd[@]}" >&2 && base_cli_healthy) + (cd "$base_cwd" && env -u NODE_ENV CI=true NODE_OPTIONS="$repair_node_options" "${repair_cmd[@]}" >&2 && base_cli_healthy) fi } @@ -770,7 +774,10 @@ if [[ -f "$worktree_cwd/package.json" && -f "$worktree_cwd/pnpm-lock.yaml" ]]; t if ( cd "$worktree_cwd" - pnpm install --prod=false "$@" + # pnpm 9.15.4 calls the deprecated url.parse() in toNerfDart on every + # install. Node 24 reports that call as DEP0169. Remove this flag + # when the pinned pnpm no longer calls url.parse() in that path. + NODE_OPTIONS="${NODE_OPTIONS:-} --disable-warning=DEP0169" pnpm install --prod=false "$@" ) >"$stdout_path" 2>"$stderr_path"; then cat "$stdout_path" cat "$stderr_path" >&2