Isolate Node module locks and CI dependency consumers

.github/actions/node/action.yml

@@ -4,6 +4,9 @@ inputs:
   node-version:
     description: Node.js version
     default: '22'
+  lockfiles:
+    description: Newline-separated lockfile paths consumed by this job
+    required: true
 runs:
   using: composite
   steps:
@@ -21,4 +24,4 @@ runs:
     - uses: actions/cache@v6
       with:
         path: ${{ steps.store.outputs.path }}
-        key: pnpm-v1-${{ runner.os }}-${{ runner.arch }}-node${{ inputs.node-version }}-10.30.3-${{ hashFiles('pnpm-lock.yaml') }}
+        key: pnpm-v1-${{ runner.os }}-${{ runner.arch }}-node${{ inputs.node-version }}-10.30.3-${{ hashFiles(inputs.lockfiles) }}

.github/workflows/check.yml

@@ -211,6 +211,10 @@ jobs:
         with:
           ref: ${{ inputs.ref || github.sha }}
       - uses: ./.github/actions/node
+        with:
+          lockfiles: |
+            packages/claude-sdk-adapter/pnpm-lock.yaml
+            packages/mcode-harness/package-lock.json
       - name: Test and package Harness adapters
         run: make check-claude-sdk check-mcode-harness
 
@@ -224,10 +228,14 @@ jobs:
         with:
           ref: ${{ inputs.ref || github.sha }}
       - uses: ./.github/actions/node
+        with:
+          lockfiles: |
+            example/parsar/pnpm-lock.yaml
+            packages/agents-client/pnpm-lock.yaml
       - name: Install dependencies and example acceptance browser
         run: |
-          make node-deps
-          pnpm exec playwright install --with-deps chrome
+          make example-deps
+          pnpm --filter @oac/parsar-example exec playwright install --with-deps chrome
       - name: Test and build optional example with browser acceptance
         run: make check-example
       - name: Upload browser failure evidence
@@ -252,6 +260,10 @@ jobs:
         with:
           ref: ${{ inputs.ref || github.sha }}
       - uses: ./.github/actions/node
+        with:
+          lockfiles: |
+            apps/web/pnpm-lock.yaml
+            packages/agents-client/pnpm-lock.yaml
       - name: Typecheck, test and build Web and clients
         run: make check-web-unit
 
@@ -265,6 +277,9 @@ jobs:
         with:
           ref: ${{ inputs.ref || github.sha }}
       - uses: ./.github/actions/node
+        with:
+          lockfiles: |
+            website/pnpm-lock.yaml
       - name: Build and test the website
         run: make check-website
 
@@ -282,10 +297,14 @@ jobs:
         with:
           ref: ${{ inputs.ref || github.sha }}
       - uses: ./.github/actions/node
+        with:
+          lockfiles: |
+            apps/web/pnpm-lock.yaml
+            packages/agents-client/pnpm-lock.yaml
       - name: Install dependencies and Web acceptance browser
         run: |
-          make node-deps
-          pnpm exec playwright install --with-deps chrome
+          make web-deps
+          pnpm --filter @oac/web exec playwright install --with-deps chrome
       - name: Verify Web workflows against isolated fixtures
         run: make check-web-acceptance OAC_WEB_TEST_SHARD=${{ matrix.shard }}/${{ strategy.job-total }}
       - name: Upload browser failure evidence
@@ -294,8 +313,8 @@ jobs:
         with:
           name: web-acceptance-${{ matrix.shard }}-${{ github.run_attempt }}
           path: |
-            playwright-report/
-            test-results/
+            apps/web/playwright-report/
+            apps/web/test-results/
           retention-days: 7
           compression-level: 0
           if-no-files-found: ignore

.github/workflows/native.yml

@@ -55,6 +55,9 @@ jobs:
       - uses: ./.github/actions/node
         with:
           node-version: '22.22.0'
+          lockfiles: |
+            packages/claude-sdk-adapter/pnpm-lock.yaml
+            packages/mcode-harness/package-lock.json
       - name: Build the native daemon and test bundle boundaries
         id: build
         run: |
@@ -95,9 +98,9 @@ jobs:
           -run 'TestWindowsPackageManager|TestWindowsRuntimeMCP'
       - name: Build pinned native components
         run: |
-          pnpm install --frozen-lockfile --filter @oac/claude-sdk-adapter...
-          pnpm --filter @oac/claude-sdk-adapter build --outDir "$RUNNER_TEMP/claude-compiled"
-          pnpm --config.inject-workspace-packages=true --config.extend-node-path=false --filter @oac/claude-sdk-adapter deploy --prod "$RUNNER_TEMP/claude-runtime"
+          pnpm --dir packages/claude-sdk-adapter install --frozen-lockfile
+          pnpm --dir packages/claude-sdk-adapter build --outDir "$RUNNER_TEMP/claude-compiled"
+          pnpm --dir packages/claude-sdk-adapter --config.extend-node-path=false --filter @oac/claude-sdk-adapter deploy --prod "$RUNNER_TEMP/claude-runtime"
           rm -rf "$RUNNER_TEMP/claude-runtime/dist"
           mv "$RUNNER_TEMP/claude-compiled" "$RUNNER_TEMP/claude-runtime/dist"
           # Reify the dedicated frozen export lock without pnpm's symlink layout.

.github/workflows/release.yml

@@ -85,6 +85,11 @@ jobs:
             core-go-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/go.mod', '**/go.sum') }}-backend-
             core-go-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/go.mod', '**/go.sum') }}-
       - uses: ./.github/actions/node
+        with:
+          lockfiles: |
+            apps/web/pnpm-lock.yaml
+            packages/agents-client/pnpm-lock.yaml
+            packages/claude-sdk-adapter/pnpm-lock.yaml
       - name: Install build prerequisites
         run: |
           sudo apt-get update

.github/workflows/website.yml

@@ -11,9 +11,6 @@ on:
       - docs/**
       - contracts/**
       - docs.json
-      - package.json
-      - pnpm-lock.yaml
-      - pnpm-workspace.yaml
       - .github/actions/node/**
       - .github/workflows/website.yml
   # Changes under website/ are checked by core-check; documentation-only
@@ -49,6 +46,8 @@ jobs:
           # Full history gives each page its last-updated date.
           fetch-depth: 0
       - uses: ./.github/actions/node
+        with:
+          lockfiles: website/pnpm-lock.yaml
       - name: Read the Pages base path
         id: pages
         if: env.PUBLISH == 'true'

.gitignore

@@ -18,8 +18,8 @@ __pycache__/
 /target/
 # `go build ./services/web` in the repository root writes this binary.
 /web
-/playwright-report/
-/test-results/
+playwright-report/
+test-results/
 /.agents/
 /.issue-agent/
 /ISSUE_AGENT.md

Makefile

@@ -95,35 +95,46 @@ check-core-container: docker-build-core
 
 node-deps:
 	pnpm install --frozen-lockfile
+	pnpm --dir website install --frozen-lockfile
+	pnpm --dir packages/claude-sdk-adapter install --frozen-lockfile
 
-check-claude-sdk: node-deps
-	pnpm --filter @oac/claude-sdk-adapter test
+check-claude-sdk:
+	pnpm --dir packages/claude-sdk-adapter install --frozen-lockfile
+	pnpm --dir packages/claude-sdk-adapter test
 	$(MAKE) build-claude-sdk-runtime
 
 .PHONY: check-web-unit check-web-acceptance check-website
 check-web: override OAC_WEB_TEST_SHARD :=
 check-web: check-web-unit check-web-acceptance
 
-check-web-unit: node-deps
-	pnpm typecheck
+web-deps:
+	pnpm --filter @oac/web... install --frozen-lockfile
+
+example-deps:
+	pnpm --filter @oac/parsar-example... install --frozen-lockfile
+
+.PHONY: web-deps example-deps
+check-web-unit: web-deps
+	pnpm --filter @oac/web... typecheck
 	pnpm test:web
 	pnpm --filter @oac/web build
 
 # The website build also checks every published documentation link.
-check-website: node-deps
-	pnpm --filter @oac/website build
-	pnpm --filter @oac/website test
+check-website:
+	pnpm --dir website install --frozen-lockfile
+	pnpm --dir website build
+	pnpm --dir website test
 
 # CI shards run in separate jobs, each with its own fixture and Web server.
 # An unset shard keeps the complete local make check gate.
-check-web-acceptance: node-deps
+check-web-acceptance: web-deps
 	pnpm test:web:acceptance $(if $(OAC_WEB_TEST_SHARD),--shard=$(OAC_WEB_TEST_SHARD))
 
 build-claude-sdk-runtime:
 	./scripts/build-claude-sdk-runtime.sh
 
 .PHONY: check-example
-check-example: node-deps
+check-example: example-deps
 	pnpm --filter @oac/parsar-example typecheck
 	pnpm --filter @oac/parsar-example test
 	pnpm --filter @oac/parsar-example build

apps/web/package.json

@@ -7,7 +7,8 @@
     "dev": "vite --host 127.0.0.1 --port 4173",
     "build": "vite build",
     "typecheck": "tsc --noEmit",
-    "test": "vitest run"
+    "test": "vitest run",
+    "test:acceptance": "playwright test"
   },
   "dependencies": {
     "@oac/agents-client": "workspace:*",
@@ -38,6 +39,8 @@
     "tailwindcss": "^4.3.3",
     "typescript": "^5.8.3",
     "vite": "^8.1.4",
-    "vitest": "^4.1.9"
+    "vitest": "^4.1.9",
+    "@types/node": "^26.1.0",
+    "@playwright/test": "^1.63.0"
   }
 }

playwright.config.ts → apps/web/playwright.config.ts

@@ -5,7 +5,7 @@ const webPort = Number(process.env.AGENTS_WEB_PORT ?? 4174);
 const reuseExistingServer = process.env.AGENTS_REUSE_E2E_SERVERS === "1";
 
 export default defineConfig({
-  testDir: "./apps/web/e2e",
+  testDir: "./e2e",
   fullyParallel: false,
   workers: 1,
   timeout: 45_000,
@@ -25,7 +25,7 @@ export default defineConfig({
   },
   webServer: [
     {
-      command: "node apps/web/e2e/fixture-console.mjs",
+      command: "node e2e/fixture-console.mjs",
       url: `http://127.0.0.1:${fixturePort}/__fixture/health`,
       reuseExistingServer,
       timeout: 15_000,