chore: lockfile lefthook

[NathanFlurry]

Description

Please include a summary of the changes and the related issue. Please also include relevant motivation and context.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes.

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

[NathanFlurry]

• chore(engine): publish engine bases in ci #4649 : 3 dependent PRs (#4650 , #4652 , #4666 )
• chore: lockfile lefthook #4647 👈 (View in Graphite)
• fix(rivetkit): surface native sqlite kv errors to callers #4645
• fix(rivetkit): prevent sleep races during disconnect and db work #4644
• fix(rivetkit): isolate engine envoys and propagate startup failures #4643
• test(rivetkit): remove wasm sqlite-only fixtures and coverage #4642
• chore(sqlite-vfs): remove wasm sqlite packages and workspace wiring #4641
• chore(rivetkit): remove wasm sqlite runtime #4614
• fix(sqlite-native): restore native startup kv preload #4639
• fix(sqlite-native): delete metadata before chunk range #4638
• fix(sqlite-native): keep truncate cache coherent #4637
• fix(sqlite-vfs): use delete range for truncate cleanup #4636
• fix(sqlite-native): restore kv error hook #4635
• perf(sqlite-native): avoid cloning cached read chunks #4634
• perf(sqlite-native): gate kv operation labels #4633
• perf(sqlite-native): reuse read cache for partial writes #4632
• perf(sqlite-native): remove delete file existence probe #4631
• fix(sqlite-native): gate native read cache behind env var #4630
• fix(pegboard): isolate runner config dc lookup failures #4625 : 1 other dependent PR (#4626 )
• docs(pegboard): note runner config upsert split write risk #4624
• fix(pegboard): unpack global runner config keys correctly #4623
• fix(pegboard-gateway): enforce tunnel message state #4622
• fix(pegboard-runner): clear terminal tunnel routes #4621
• fix(pegboard): skip protocol version keys in runner pool backfill #4620
• fix(pegboard): create missing normal runner configs #4619
• fix(epoxy): reuse cached optimistic value #4618
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[claude]

PR Review: chore: lockfile lefthook

Overview: Adds pre-commit lockfile validation hooks, fixes pnpm-lock.yaml to use workspace resolution for @rivetkit/engine-api-full (was pinned to a PR preview URL), removes a stale Cargo workspace dep, and fixes a Rust formatting issue.

Strengths:

• cargo-lock and pnpm-lock pre-commit hooks catch lockfile drift early.
• pnpm hook uses --frozen-lockfile --ignore-scripts: strict consistency and no postinstall script execution.
• Switching @rivetkit/engine-api-full from a pkg.pr.new PR preview URL to workspace:* is important since that URL can disappear.
• database.rs formatting correctly aligns .map_err() with the method chain.

Concerns:

1. sqlite-vfs package conflicts with CLAUDE.md

The lockfile now includes rivetkit-typescript/packages/sqlite-vfs with @rivetkit/sqlite and @rivetkit/sqlite-vfs as dependencies. CLAUDE.md says not to add @rivetkit/sqlite, @rivetkit/sqlite-vfs, or other WebAssembly SQLite fallbacks. If this package is intentional (e.g., an internal implementation package), CLAUDE.md should be updated with the exception and reasoning to avoid confusion for future contributors.

2. No glob filters on lockfile hooks

Neither hook has a glob: filter so both run on every commit. cargo metadata --locked is fast, but pnpm install --frozen-lockfile can be slow on cold node_modules. Scoping the hooks to only fire when Cargo manifests or package.json files change would reduce friction on unrelated commits.

3. Verify Cargo workspace dep removal is safe

Removing [workspace.dependencies.rivetkit-sqlite-native] will break the build if any Cargo.toml still references rivetkit-sqlite-native.workspace = true. A grep across .toml files would confirm it is safe to drop.

4. Minor: remaining typo

The TODO comment still reads figrue instead of figure. Low priority since you are already touching this line.

Summary:

• Lockfile hooks: good idea, minor concern without glob filters
• engine-api-full workspace resolution: correct fix
• sqlite-vfs package: conflicts with CLAUDE.md -- update docs if intentional
• Cargo workspace dep removal: verify no remaining consumers
• Rust formatting: clean fix