SkillRepo
Sign InSign Up
Catalog
vercel/update-harness-dependencies

vercel

update-harness-dependencies

Update the primary SDK dependencies of harness packages. Use when asked to update the harness SDKs or harness adapter dependencies.

NewUpdated Oct 21, 2026

Update the harness packages

The harness adapters are all the packages/harness-* packages. They each rely on one or more third-party packages for the respective harness's primary SDK. It is crucial to keep those dependencies up to date.

Below you find the instructions on how to update those packages to their latest versions, while adhering to the minimum release age defined in pnpm-workspace.yaml.

Update the harness dependency packages

Run the following commands to update each harness's primary SDK packages.

  • For bridge harnesses (e.g. Claude Code), this will update the packages in devDependencies, while the actual package versions used as dependencies are only relevant to the harness's bridge itself.
  • For non-bridge harnesses (e.g. Pi), this will update the packages in dependencies.

Run these commands exactly as below:

# ACP
pnpm --filter harness-acp update @agentclientprotocol/sdk @modelcontextprotocol/sdk --latest --lockfile-only
# Claude Code
pnpm --filter harness-claude-code update @anthropic-ai/claude-agent-sdk @modelcontextprotocol/sdk --latest --lockfile-only
# Cline
pnpm --filter harness-cline update @cline/agents @cline/core --latest --lockfile-only
# Codex
pnpm --filter harness-codex update @openai/codex --latest --lockfile-only
# Deep Agents
pnpm --filter harness-deepagents update @langchain/core @langchain/langgraph deepagents langchain langsmith --latest --lockfile-only
# GitHub Copilot
pnpm --filter harness-github-copilot update @github/copilot --latest --lockfile-only
# Grok Build
pnpm --filter harness-grok-build update @xai-official/grok --latest --lockfile-only
# OpenCode
pnpm --filter harness-opencode update @opencode-ai/sdk --latest --lockfile-only
# Pi
pnpm --filter harness-pi update @earendil-works/pi-coding-agent --latest --lockfile-only

For the bridge dependencies of bridge harnesses, you must additionally run the following commands. It is important to specify the config.minimumReleaseAge flag in accordance with what pnpm-workspace.yaml defines, because for these commands the --ignore-workspace flag is needed.

Run these commands exactly as below:

# ACP
pnpm --dir packages/harness-acp/src/v1/bridge update @agentclientprotocol/sdk @modelcontextprotocol/sdk --latest --ignore-workspace --config.minimumReleaseAge=4320
# Claude Code
pnpm --dir packages/harness-claude-code/src/bridge update @anthropic-ai/claude-agent-sdk @anthropic-ai/claude-code @modelcontextprotocol/sdk --latest --ignore-workspace --config.minimumReleaseAge=4320
# Codex
pnpm --dir packages/harness-codex/src/bridge update @openai/codex --latest --ignore-workspace --config.minimumReleaseAge=4320
# Deep Agents
pnpm --dir packages/harness-deepagents/src/bridge update @langchain/anthropic @langchain/core @langchain/langgraph deepagents langchain langsmith --latest --ignore-workspace --config.minimumReleaseAge=4320
# GitHub Copilot
pnpm --dir packages/harness-github-copilot/src/bridge update @agentclientprotocol/sdk @github/copilot @modelcontextprotocol/sdk --latest --ignore-workspace --config.minimumReleaseAge=4320
# Grok Build
pnpm --dir packages/harness-grok-build/src/bridge update @agentclientprotocol/sdk @modelcontextprotocol/sdk @xai-official/grok --latest --ignore-workspace --config.minimumReleaseAge=4320
# OpenCode
pnpm --dir packages/harness-opencode/src/bridge update @opencode-ai/sdk opencode-ai --latest --ignore-workspace --config.minimumReleaseAge=4320

The following harness adapter uses an unversioned installer script instead of an NPM package for its CLI and therefore can be ignored:

  • packages/harness-cursor

Update the pinned fx CLI version

The fx harness adapter pins the fx CLI release with FX_VERSION in packages/harness-fx/src/fx-harness.ts. To discover the latest release, run:

curl -fsSL https://releases.fx.sh/latest.txt

Update FX_VERSION to that version without a leading v, then run the fx harness tests:

pnpm --filter harness-fx test

Example dependencies

Check the package.json files in examples/harness-e2e-next and examples/harness-e2e-tui for any of the above SDKs they depend on. Those dependencies need to be updated to match the exact version used in the packages as well.

Update ACP and MCP SDKs everywhere

Find every harness package and bridge manifest that declares either SDK:

rg -n '"(@agentclientprotocol/sdk|@modelcontextprotocol/sdk)"' packages/harness-* --glob 'package.json'

For each matching workspace package manifest, update its declared SDKs with pnpm --filter. Replace the placeholders with the harness workspace name and the SDK package names found in that manifest:

pnpm --filter <harness-name> update <sdk-package>... --latest --lockfile-only

# Example
pnpm --filter harness-acp update @agentclientprotocol/sdk @modelcontextprotocol/sdk --latest --lockfile-only

For each matching bridge manifest, run pnpm --dir in the directory containing that manifest:

pnpm --dir <bridge-directory> update <sdk-package>... --latest --ignore-workspace --config.minimumReleaseAge=4320

# Example
pnpm --dir packages/harness-acp/src/v1/bridge update @agentclientprotocol/sdk @modelcontextprotocol/sdk --latest --ignore-workspace --config.minimumReleaseAge=4320

Align ACP npm-locked bridge manifests

ACP adapters that use an npm-locked source install their own bridge manifest instead of the harness-acp bridge manifest. packages/harness-acp/src/v1/bridge/package.json is the authoritative source for the bridge dependencies, and every npm-locked bridge manifest must declare each of its dependencies at the exact same version:

  • packages/harness-github-copilot/src/bridge/package.json
  • packages/harness-grok-build/src/bridge/package.json
  • examples/ai-functions/src/lib/codex-acp-bridge/package.json
  • examples/harness-e2e-next/agent/harness/acp-codex/bridge/package.json

After updating the harness-acp bridge manifest, copy its dependency versions into each of these manifests and regenerate their lockfiles:

pnpm --dir packages/harness-github-copilot/src/bridge install --lockfile-only --ignore-workspace --config.minimumReleaseAge=4320
pnpm --dir packages/harness-grok-build/src/bridge install --lockfile-only --ignore-workspace --config.minimumReleaseAge=4320
pnpm --dir examples/ai-functions/src/lib/codex-acp-bridge install --lockfile-only --ignore-workspace --config.minimumReleaseAge=4320
pnpm --dir examples/harness-e2e-next/agent/harness/acp-codex/bridge install --lockfile-only --ignore-workspace --config.minimumReleaseAge=4320

Verification

Run the verification script to ensure all relevant dependency versions are aligned:

./tools/verify-harness-adapter-deps.mjs

If this script shows errors, you must address them, then rerun the verification script until it passes.

Files1
1 files · 552 B

Select a file to preview

Overall Score

81/100

Grade

B

Good

Grades are signals, not a certification. Always review a skill yourself before use.

Safety

82

Quality

84

Clarity

85

Completeness

76

Summary

This skill provides structured instructions for updating harness package dependencies across a monorepo. It guides agents through running pnpm commands to update SDK packages for various harness adapters, pinning the fx CLI version, and verifying alignment across all harness manifests. The skill is domain-specific and operationally scoped to a well-defined project structure.

Static Analysis Findings

1 finding

Patterns detected by deterministic static analysis before AI scoring. Hover over any finding code for detailed information and remediation guidance.

Remote Code Execution
SEC-031Script Download

Dynamic script download for execution

SKILL.mdcurl -fsSL https://releases.fx.sh
70% confidenceCWE-494: Download of Code Without Integrity Check

Detected Capabilities

shell executionpackage manager operations (pnpm)file writes to lockfilesnetwork request (curl to releases.fx.sh)project-scoped file readsregex-based file search (ripgrep)

Trigger Keywords

Phrases that agents use to match this skill to user intent.

update harness dependenciessdk version bumpupdate adapter packagespin fx cli versionalign bridge manifestsupdate pnpm lockfiles

Risk Signals

INFO

curl -fsSL https://releases.fx.sh/latest.txt to retrieve CLI version

SKILL.md, line ~55
WARNING

Dynamic network request to external URL (releases.fx.sh)

SKILL.md, line ~55 (SEC-031)

Referenced Domains

External domains referenced in skill content, detected by static analysis.

releases.fx.shwww.apache.org

Use Cases

  • Update Claude Code, ACP, or other harness SDK dependencies to their latest versions
  • Pin the fx CLI version to the latest release
  • Synchronize SDK versions across bridge and non-bridge harness packages
  • Align ACP npm-locked bridge manifests with the authoritative harness-acp bridge
  • Verify all harness dependency versions are correctly aligned across the monorepo

Quality Notes

  • Clear, well-organized instructions with separate sections for each update task
  • Explicitly documents which harness packages use which dependencies, reducing ambiguity
  • Includes specific pnpm commands with correct flags (--latest, --lockfile-only, --ignore-workspace, --config.minimumReleaseAge) showing deep domain knowledge
  • Verification step at the end ensures all changes are correct
  • Example code blocks are concrete and copy-paste ready
  • Explicitly notes cursor harness can be ignored, showing attention to edge cases
  • Scope is limited to a specific project structure (packages/harness-*)
  • Network request (curl to releases.fx.sh) is intentional and well-documented — fetches version metadata, not executable code
Model: claude-haiku-4-5-20251001Analyzed: Oct 21, 2026

Reviews

Add this skill to your library to leave a review.

No reviews yet

Be the first to share your experience.

Version History

  1. v1.6

    Content updated

    ✦ AIAdds @agentclientprotocol/sdk and @modelcontextprotocol/sdk to GitHub Copilot bridge update command; adds new section requiring alignment of npm-locked bridge manifests with identical dependency…

    2026-10-21

    LATEST
  2. v1.5

    Content updated

    ✦ AIAdds manual step to pin fx CLI version by fetching latest release via curl and updating FX_VERSION.

    2026-10-17

    View This Version
  3. v1.4

    Content updated

    ✦ AIAdds @cline/core to Cline harness update command; removes pnpm-workspace.yaml version-sync guidance.

    2026-10-09

    View This Version
  4. v1.3

    Content updated

    ✦ AIAdds new section with rg and pnpm commands to systematically find and update ACP and MCP SDKs across all harness packages and bridge manifests.

    2026-10-08

    View This Version
  5. v1.2

    Content updated

    ✦ AIUpdates package name from @openai/codex-sdk to @openai/codex in two pnpm commands.

    2026-09-25

    View This Version
  6. v1.1

    Content updated

    ✦ AIAdds update commands for ACP, Cline, GitHub Copilot, and Grok Build harnesses; documents pnpm-workspace.yaml sync requirement for bridge CLI packages.

    2026-09-09

    View This Version
  7. v1.0

    2026-07-22

    View This VersionInitial version

Use vercel/update-harness-dependencies in your dev environment

Start a Developer trial

Command Palette

Search for a command to run...