fix(deps): add missing runtime deps @toon-format/toon and safe-regex

[chirag127]

Summary

Two packages are imported at runtime by the stacked compression pipeline but are missing from dependencies:

• @toon-format/toon — imported by open-sse/services/compression/engines/headroom/toon.ts:3

  import { encode as toonEncode, decode as toonDecode } from "@toon-format/toon";

• safe-regex — imported by open-sse/services/compression/engines/ccr/ccrQuery.ts:3

  import safeRegex from "safe-regex";

@types/safe-regex is already declared (types only) but the runtime package is not. @toon-format/toon has no declaration at all.

Impact

Both engines are wired into the default stacked compression pipeline. On a fresh pnpm install / npm install (no stale node_modules from a previous OmniRoute install carrying these packages transitively), any request routed through the compression pipeline crashes with:

Error [ERR_MODULE_NOT_FOUND]: Cannot find package "@toon-format/toon" ...
Error [ERR_MODULE_NOT_FOUND]: Cannot find package "safe-regex" ...

This is related to (but distinct from) #5708 — that issue tracks pnpm-install-no-op on fresh clones. This issue is that even a working install cannot resolve these two because they were never declared.

Fix

     "@toon-format/toon": "^2.3.0",
     "@types/mdx": "^2.0.13",
     ...
     "safe-regex": "^2.1.1",
     "selfsigned": "^5.5.0",

Two-line change to package.json.

Test plan

• Delete node_modules and re-install with pnpm install
• Trigger a chat completion routed through the compression pipeline
• Confirm neither engine throws ERR_MODULE_NOT_FOUND

Notes

Discovered while auditing our fork at oriz-org/OmniRoute. Filing as PR rather than issue because the fix is trivial.

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[diegosouzapw]

Thanks for the dependency audit, @chirag127. I checked both packages against the monorepo before acting, and they're already declared in the workspace that imports them, so this change is redundant:

• @toon-format/toon — declared in open-sse/package.json ("@toon-format/toon": "^2.3.0"); imported only from open-sse/services/compression/engines/headroom/toon.ts.
• safe-regex — declared in open-sse/package.json ("safe-regex": "^2.1.1"); imported from open-sse/services/compression/engines/{ccr,rtk,riskGate}/….

open-sse is a workspace ("workspaces": ["open-sse"]), so its own package.json is authoritative for these runtime deps — adding them to the root package.json duplicates the declaration without fixing anything. (The root correctly carries only @types/safe-regex, the type shim.)

If you actually hit an ERR_MODULE_NOT_FOUND at runtime, could you share the exact install steps + error output? That would point to a genuinely missing declaration worth fixing. Also, the base branch should be release/v3.8.43 (the active cycle), not main.

Leaving this open rather than merging — appreciate you keeping an eye on the dependency graph.

[chirag127]

Hi Diego, Thanks for the update on the PR and for merging it into the release/v3.8.43 branch. Could you let me know when this release cycle is expected to be completed and shipped? Regards, Chirag Singhal

…

On Wed, Jul 1, 2026 at 5:30 PM Diego Rodrigues de Sa e Souza < ***@***.***> wrote: Merged #5771 <#5771> into release/v3.8.43. — Reply to this email directly, view it on GitHub <#5771?email_source=notifications&email_token=ASKRYUNHZOLOR7DPIYFH4GL5CT4MTA5CNFSNUABQM5UWIORPF5TWS5BNNB2WEL2JONZXKZKFOZSW45CON52GSZTJMNQXI2LPNYXTENZUGI3TAMJWGMYTPJTSMVQXG33OU5WWK3TUNFXW5JLFOZSW45FMMZXW65DFOJPWG3DJMNVQ#event-27427016317>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ASKRYUIPGYONQ64W5UQJBN35CT4MTAVCNFSNUABGKJSXA33TNF2G64TZHMYTCNJXGEYDEMRYGI5US43TOVSTWNBXHAZDIOBQGY2TPILWAI> . You are receiving this because you were mentioned.Message ID: ***@***.***>