yiliang114 · Sep 20, 2026 · Sep 14, 2026 · Sep 14, 2026 · Sep 14, 2026 · Sep 14, 2026
diff --git a/.github/actions/pnpm-store-cache/action.yml b/.github/actions/pnpm-store-cache/action.yml
@@ -0,0 +1,20 @@
+name: 'pnpm store cache'
+description: >-
+  Restore and save the pnpm content-addressable store on hosted runners,
+  keyed on pnpm-lock.yaml. Self-hosted runners keep their store on local disk
+  between jobs, so they do not need this.
+
+runs:
+  using: 'composite'
+  steps:
+    - name: 'Locate the pnpm store'
+      id: 'store'
+      shell: 'bash'
+      run: 'echo "path=$(corepack pnpm store path --silent)" >> "${GITHUB_OUTPUT}"'
+
+    - name: 'Cache the pnpm store'
+      uses: 'actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830' # v4.3.0
+      with:
+        path: '${{ steps.store.outputs.path }}'
+        key: "pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}"
+        restore-keys: 'pnpm-store-${{ runner.os }}-'
diff --git a/.github/scripts/ci-disk-pressure.test.mjs b/.github/scripts/ci-disk-pressure.test.mjs
@@ -42,9 +42,10 @@ function lintStep(name) {
 }
 
 describe('ci.yml disk-pressure evidence', () => {
-  it('starts sampling before npm ci and preserves those samples for upload', () => {
+  it('starts sampling before the install and preserves those samples for upload', () => {
     const install = step('Install dependencies').run;
-    const npmCi = install.indexOf('npm ci');
+    const npmCi = install.indexOf('pnpm install');
+    assert.ok(npmCi !== -1, 'the install step must run pnpm install');
 
     assert.match(
       install,
@@ -241,9 +242,11 @@ describe('ci.yml disk-pressure evidence', () => {
 
   it('keeps install failure status while writing the pre-install sample', () => {
     const root = mkdtempSync(join(tmpdir(), 'ci-disk-pressure-'));
-    const npm = join(root, 'npm');
-    writeFileSync(npm, '#!/usr/bin/env bash\nexit 42\n');
-    chmodSync(npm, 0o755);
+    // The install step runs `corepack pnpm install`; stub corepack so the
+    // failing exit comes from the install command itself.
+    const corepack = join(root, 'corepack');
+    writeFileSync(corepack, '#!/usr/bin/env bash\nexit 42\n');
+    chmodSync(corepack, 0o755);
 
     try {
       const result = spawnSync(

diff --git a/.github/scripts/ci/classify-platform-sensitivity.mjs b/.github/scripts/ci/classify-platform-sensitivity.mjs
@@ -47,7 +47,7 @@ const RUNNER_CONFIG = /(?:^|\/)vitest(?:\.[^/]*)?\.config\.[cm]?[jt]s$/i;
 
 // The dependency and script manifests: a changed `test:ci`, a native module, or
 // an optional per-platform dependency changes what each lane executes.
-const MANIFEST = new Set(['package.json', 'package-lock.json']);
+const MANIFEST = new Set(['package.json', 'pnpm-lock.yaml']);
 
 // Source subtrees whose subject IS the host.
 //

diff --git a/.github/scripts/ci/classify-platform-sensitivity.test.mjs b/.github/scripts/ci/classify-platform-sensitivity.test.mjs
@@ -75,7 +75,7 @@ test('the runner configuration decides which lane runs what', () => {
 
 test('the manifests change what each lane executes', () => {
   assert.equal(classifyChangedFiles(['package.json']), PLATFORM_SENSITIVE);
-  assert.equal(classifyChangedFiles(['package-lock.json']), PLATFORM_SENSITIVE);
+  assert.equal(classifyChangedFiles(['pnpm-lock.yaml']), PLATFORM_SENSITIVE);
   // A workspace manifest is not the root one; it reaches the lanes through
   // the subsystem rules or not at all.
   assert.equal(

diff --git a/.github/scripts/qwen-triage-workflow.test.mjs b/.github/scripts/qwen-triage-workflow.test.mjs
@@ -33,7 +33,7 @@ const cacheProducerPath = join(
   dirname(fileURLToPath(import.meta.url)),
   '..',
   'workflows',
-  'npm-cache.yml',
+  'pnpm-store.yml',
 );
 const cacheProducerDoc = parse(readFileSync(cacheProducerPath, 'utf8'));
 const prWorkflowPath = join(
@@ -1139,16 +1139,19 @@ describe('qwen-triage: Stage 1e revert-pattern signals', () => {
   });
 });
 
-describe('qwen-triage: npm cache restore-only invariant', () => {
+describe('qwen-triage: pnpm store restore-only invariant', () => {
   for (const [jobName, jobDef] of [
     ['verify', verifyJob],
     ['tmux-testing', tmuxJob],
   ]) {
     it(`${jobName}: uses actions/cache/restore with no save path`, () => {
       const cacheStep = jobDef.steps.find(
-        (s) => s.name === 'Restore npm cache',
+        (s) => s.name === 'Restore pnpm store',
+      );
+      assert.ok(
+        cacheStep,
+        `'Restore pnpm store' step must exist in ${jobName}`,
       );
-      assert.ok(cacheStep, `'Restore npm cache' step must exist in ${jobName}`);
       assert.match(
         cacheStep.uses,
         /^actions\/cache\/restore@/,
@@ -1165,9 +1168,9 @@ describe('qwen-triage: npm cache restore-only invariant', () => {
       }
     });
 
-    it(`${jobName}: npm ci --cache matches the restored directory`, () => {
+    it(`${jobName}: pnpm install --store-dir matches the restored directory`, () => {
       const cacheStep = jobDef.steps.find(
-        (s) => s.name === 'Restore npm cache',
+        (s) => s.name === 'Restore pnpm store',
       );
       const prepareStep = jobDef.steps.find(
         (s) => s.name === 'Install and build PR app',
@@ -1182,25 +1185,25 @@ describe('qwen-triage: npm cache restore-only invariant', () => {
       );
       assert.ok(dir, 'cache path must resolve to a directory name');
       assert.ok(
-        prepareStep.run.includes(`--cache "$RUNNER_TEMP/${dir}"`),
-        `npm ci must use --cache "$RUNNER_TEMP/${dir}"`,
+        prepareStep.run.includes(`--store-dir "$RUNNER_TEMP/${dir}"`),
+        `pnpm install must use --store-dir "$RUNNER_TEMP/${dir}"`,
       );
     });
 
-    it(`${jobName}: clears stale npm cache before restore`, () => {
+    it(`${jobName}: clears stale pnpm store before restore`, () => {
       const clearIdx = jobDef.steps.findIndex(
-        (s) => s.name === 'Clear stale npm cache',
+        (s) => s.name === 'Clear stale pnpm store',
       );
       const restoreIdx = jobDef.steps.findIndex(
-        (s) => s.name === 'Restore npm cache',
+        (s) => s.name === 'Restore pnpm store',
       );
       assert.ok(
         clearIdx !== -1,
-        `'Clear stale npm cache' step must exist in ${jobName}`,
+        `'Clear stale pnpm store' step must exist in ${jobName}`,
       );
       assert.ok(
         restoreIdx !== -1,
-        `'Restore npm cache' step must exist in ${jobName}`,
+        `'Restore pnpm store' step must exist in ${jobName}`,
       );
       assert.ok(
         clearIdx < restoreIdx,
@@ -1212,7 +1215,7 @@ describe('qwen-triage: npm cache restore-only invariant', () => {
         'clear step must rm -rf the cache directory',
       );
       const cacheStep = jobDef.steps.find(
-        (s) => s.name === 'Restore npm cache',
+        (s) => s.name === 'Restore pnpm store',
       );
       const dir = cacheStep.with.path.replace(
         /^\$\{\{\s*runner\.temp\s*\}\}\//,
@@ -1226,34 +1229,34 @@ describe('qwen-triage: npm cache restore-only invariant', () => {
 
     it(`${jobName}: reports the cache hit so a permanent miss is visible`, () => {
       const cacheStep = jobDef.steps.find(
-        (s) => s.name === 'Restore npm cache',
+        (s) => s.name === 'Restore pnpm store',
       );
       assert.equal(
         cacheStep.id,
-        'npm-cache',
+        'pnpm-store',
         'restore step needs an id so its cache-hit output is readable',
       );
       const reportStep = jobDef.steps.find(
-        (s) => s.name === 'Report npm cache hit',
+        (s) => s.name === 'Report pnpm store hit',
       );
-      assert.ok(reportStep, "'Report npm cache hit' step must exist");
+      assert.ok(reportStep, "'Report pnpm store hit' step must exist");
       assert.match(
         reportStep.run,
-        /steps\.npm-cache\.outputs\.cache-hit/,
+        /steps\.pnpm-store\.outputs\.cache-hit/,
         'report step must surface the cache-hit output',
       );
     });
   }
 });
 
-describe('qwen-triage: npm cache producer workflow', () => {
+describe('qwen-triage: pnpm store producer workflow', () => {
   const saveJob = cacheProducerDoc.jobs.save;
 
   it('triggers on push to main only', () => {
     const push = cacheProducerDoc.on.push ?? cacheProducerDoc[true]?.push;
     assert.ok(push, 'must have a push trigger');
     assert.deepEqual(push.branches, ['main']);
-    assert.deepEqual(push.paths, ['package-lock.json']);
+    assert.deepEqual(push.paths, ['pnpm-lock.yaml']);
   });
 
   it('saves with the same key and path the triage lanes restore', () => {
@@ -1266,7 +1269,7 @@ describe('qwen-triage: npm cache producer workflow', () => {
       ['tmux-testing', tmuxJob],
     ]) {
       const restoreStep = jobDef.steps.find(
-        (s) => s.name === 'Restore npm cache',
+        (s) => s.name === 'Restore pnpm store',
       );
       assert.equal(
         saveStep.with.path,
@@ -1292,12 +1295,12 @@ describe('qwen-triage: npm cache producer workflow', () => {
     );
     assert.ok(dir, 'save path must resolve to a directory name');
     const populateStep = saveJob.steps.find(
-      (s) => s.name === 'Populate npm cache',
+      (s) => s.name === 'Populate pnpm store',
     );
-    assert.ok(populateStep, "'Populate npm cache' step must exist");
+    assert.ok(populateStep, "'Populate pnpm store' step must exist");
     assert.ok(
-      populateStep.run.includes(`--cache "$RUNNER_TEMP/${dir}"`),
-      `populate step must fill the saved cache directory (--cache "$RUNNER_TEMP/${dir}")`,
+      populateStep.run.includes(`--store-dir "$RUNNER_TEMP/${dir}"`),
+      `populate step must fill the saved store directory (--store-dir "$RUNNER_TEMP/${dir}")`,
     );
   });
 

diff --git a/.github/scripts/run-autofix-review-verification.sh b/.github/scripts/run-autofix-review-verification.sh
@@ -731,7 +731,7 @@ sensitive_class_of() {
     scripts/tests/*) ;;
     scripts/*) echo 'repo-scripts' ;;
     .npmrc | .nvmrc | */.npmrc | */.nvmrc) echo 'toolchain-config' ;;
-    package-lock.json | npm-shrinkwrap.json | */package-lock.json | */npm-shrinkwrap.json | patches/*) echo 'supply-chain' ;;
+    package-lock.json | npm-shrinkwrap.json | */package-lock.json | */npm-shrinkwrap.json | pnpm-lock.yaml | pnpm-workspace.yaml | .pnpmfile.mjs | patches/*) echo 'supply-chain' ;;
     .gitattributes | */.gitattributes) echo 'measurement-config' ;;
     *) case "${f##*/}" in
       eslint.config.* | eslint.legacy-filenames.mjs | eslint.legacy-core-barrel-imports.mjs | vitest.config.* | tsconfig.json | tsconfig.*.json)

diff --git a/.github/scripts/run-release-step.sh b/.github/scripts/run-release-step.sh
@@ -123,7 +123,7 @@ case "${step}" in
 
   push-release-branch)
     release_branch_name="${BRANCH_NAME:?}"
-    git add package.json package-lock.json packages/*/package.json packages/channels/*/package.json integrations/*/package.json integrations/*/qwen-extension.json
+    git add package.json pnpm-lock.yaml packages/*/package.json packages/channels/*/package.json integrations/*/package.json integrations/*/qwen-extension.json
     if git diff --staged --quiet; then
       echo "No version changes to commit"
     else

diff --git a/.github/workflows/.size-baseline b/.github/workflows/.size-baseline
@@ -17,56 +17,55 @@
 3480 audio-capture-prebuilds.yml
 9023 auto-minimize-spam.yml
 9256 build-and-publish-image.yml
-49610 cd-cua-driver.yml
-2076 cd-mobile-mcp.yml
-137297 ci.yml
+50773 cd-cua-driver.yml
+2222 cd-mobile-mcp.yml
+137804 ci.yml
 1482 codeql.yml
 9389 comment-attachment-guard.yml
 1634 desktop-packaging-check.yml
-35684 desktop-release.yml
+38401 desktop-release.yml
 2038 docs-page-action.yml
 10005 dsw-swe-verified-release.yml
-32363 e2e.yml
-11394 finalize-release.yml
+33227 e2e.yml
+11634 finalize-release.yml
 16647 live-host-release.yml
 5950 live-host.yml
 1343 mobile-shell.yml
 7642 main-ci-failure-issue.yml
-1686 npm-cache.yml
-2709 pnpm-lock-freshness.yml
+2277 pnpm-store.yml
 2489 pnpm-worktree-smoke.yml
 7299 pr-force-push-reminder.yml
 6495 pr-self-report-label.yml
 9646 qwen-autofix-fork-bridge.yml
 5942 qwen-autofix-fork-signal.yml
-469165 qwen-autofix.yml
+466739 qwen-autofix.yml
 7061 qwen-ci-flaky-rerun.yml
-265415 qwen-code-pr-review.yml
+265236 qwen-code-pr-review.yml
 107075 qwen-fleet-shepherd.yml
 22680 qwen-issue-followup-bot.yml
 5760 qwen-pr-safety-precheck.yml
 2518 qwen-review-runner-schedule.yml
 27648 qwen-triage-finalize.yml
-350381 qwen-triage.yml
-9657 release-sdk-java.yml
-22037 release-sdk-python.yml
-19094 release-sdk.yml
-14546 release-vscode-companion.yml
-34861 release.yml
-43717 repo-hygiene.yml
+354514 qwen-triage.yml
+9701 release-sdk-java.yml
+22345 release-sdk-python.yml
+20008 release-sdk.yml
+16655 release-vscode-companion.yml
+35955 release.yml
+44285 repo-hygiene.yml
 1079 scorecard-monthly.yml
-10691 sdk-java.yml
+12011 sdk-java.yml
 3886 sdk-python.yml
-3197 security-checks.yml
+5595 security-checks.yml
 6777 serve-ab-publish.yml
-17013 serve-ab.yml
+20096 serve-ab.yml
 2641 stale.yml
 11328 sync-desktop-to-oss.yml
 10018 sync-live-host-to-oss.yml
-10988 sync-release-to-oss.yml
-2508 tui-parity.yml
+11206 sync-release-to-oss.yml
+2676 tui-parity.yml
 7187 update-ecs-runner-qwen.yml
 2307 web-shell-visuals-cleanup.yml
 20047 web-shell-visuals-publish.yml
-16384 web-shell-visuals.yml
-4712 windows-runner-smoke.yml
+17127 web-shell-visuals.yml
+5155 windows-runner-smoke.yml
diff --git a/.github/workflows/cd-cua-driver.yml b/.github/workflows/cd-cua-driver.yml
@@ -699,14 +699,12 @@ jobs:
       - uses: 'actions/setup-node@v4'
         with:
           node-version: '22'
-          cache: 'npm'
-          cache-dependency-path: 'package-lock.json'
           registry-url: 'https://registry.npmjs.org'
           scope: '@qwen-code'
       - name: 'Install npm 11'
         run: 'npm install --global [email protected]'
       - name: 'Install workspace dependencies'
-        run: 'npm ci --ignore-scripts --no-audit --no-fund --progress=false'
+        run: 'corepack pnpm install --frozen-lockfile --ignore-scripts --prefer-offline --reporter=append-only'
       - name: 'Test standalone Node REPL package'
         working-directory: 'packages/node-repl'
         run: |

diff --git a/.github/workflows/cd-mobile-mcp.yml b/.github/workflows/cd-mobile-mcp.yml
@@ -29,8 +29,7 @@ jobs:
       - uses: 'actions/setup-node@v5'
         with:
           node-version-file: '.nvmrc'
-          cache: 'npm'
-          cache-dependency-path: 'package-lock.json'
+          package-manager-cache: false
           registry-url: 'https://registry.npmjs.org'
           scope: '@qwen-code'
 
@@ -47,13 +46,14 @@ jobs:
           fi
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
+      # mobile-mcp is a root workspace package, so it installs from the root
+      # pnpm lockfile, as `npm ci` in this directory used the root npm one.
       - name: 'Install dependencies'
-        working-directory: 'packages/mobile-mcp'
-        run: 'npm ci --ignore-scripts'
+        run: 'corepack pnpm install --frozen-lockfile --ignore-scripts --reporter=append-only'
 
       - name: 'Set version'
         working-directory: 'packages/mobile-mcp'
-        run: 'npm version "${{ steps.version.outputs.version }}" --no-git-tag-version'
+        run: 'npm version "${{ steps.version.outputs.version }}" --no-git-tag-version --no-workspaces-update'
 
       - name: 'Build'
         working-directory: 'packages/mobile-mcp'