[valuecodes]

Brings this repo's tooling in line with valuecodes/agentic-monorepo-starter: the maintain-kit updates workflow, pnpm settings in pnpm-workspace.yaml with engineStrict, the starter's git hooks, and Node.js 26. No app code changes.

Add the maintain-kit updates workflow

.github/workflows/maintain-kit-updates.yml is the starter's file, unchanged. Every week it calls updates.yml from valuecodes/maintain-kit and keeps one PR open per update kind (Node.js, pnpm, catalog:) on a maintain-kit/<kind> branch, for updates on the current major only. Nothing auto-merges. It pins the same maintain-kit commit (e5bf1d2, v1.0.0) as the dashboard, secret-scan and workflow-lint callers. AGENTS.md describes it, using the starter's wording, and README adds the repo setting it needs. workflow-lint in checks.yml already covers the new file.

Move pnpm settings to pnpm-workspace.yaml and enforce engines

• .npmrc is deleted. It held only save-prefix= and save-exact=true, and pnpm 12 reads only auth settings from .npmrc, so neither setting had any effect.
• pnpm-workspace.yaml gets saveExact: true and engineStrict: true, with the starter's comments and placement. engineStrict makes the install fail when a non-optional dependency's own engines excludes the running Node.js, instead of only warning.
• engines.pnpm is removed from package.json. packageManager already pins pnpm.
• AGENTS.md adds engineStrict to the list of install guards.

pnpm install --frozen-lockfile --force passes with engineStrict on both Node.js 24.22.1 and 26.12.1.

Add pre-commit and pre-push git hooks

• .githooks/pre-commit and .githooks/pre-push are the starter's files, unchanged (mode 755). pre-commit runs format:check, lint and gitleaks git --staged. The scan fails closed, so a commit is refused when gitleaks is not installed. pre-push runs typecheck, test and knip. This repo already had all of those scripts.
• The root prepare script turns the hooks on during pnpm install (git config --local core.hooksPath .githooks). Existing clones need one pnpm install or git config core.hooksPath .githooks.
• .claude/settings.json denies git commit --no-verify, git commit -n and git push --no-verify.
• AGENTS.md replaces "There are no git hooks" with a section on the hooks, based on the starter and cli-agent-sandbox, and adds a rule against --no-verify. CI still scans the full history with the gitleaks version pinned in maintain-kit's secret-scan.yml. README now says how to install gitleaks for the hook, where it used to suggest running the scan by hand.

Update Node.js to 26

• .nvmrc is now 26.12.1, and the @types/node catalog entry is now 26.6.5 (its comment now says the Node 26 line). The lockfile changes only for @types/node.
• engines.node stays ^24.22.1 || >=26.12.1, the same as the starter.
• AGENTS.md and README now say Node.js 26.
• CI and migrations.yml both get Node.js through .github/actions/setup, which reads .nvmrc, so no workflow changes were needed. No other file outside the lockfile mentioned Node 24.
• The Workers are not affected. Their runtime comes from compatibility_date and the nodejs_compat flag in each wrangler.jsonc, not from .nvmrc, so those stay as they are.

Manual repo setting

Turn on Settings → Actions → General → "Allow GitHub Actions to create and approve pull requests", or the updates workflow cannot open its PRs. Those PRs are opened with GITHUB_TOKEN, so their pull_request checks wait until someone with write access clicks Approve workflows to run in the PR.

Kept or skipped

• The @types/node entry in updateConfig.ignoreDependencies stays, so the type definitions still follow the .nvmrc major.
• The starter's AGENTS.md line about setting the Cloudflare NODE_VERSION / PNPM_VERSION build variables after an update was left out. This repo deploys its Workers from GitHub Actions with wrangler, not through Cloudflare's build system.
• Catalog versions, apart from @types/node, and packageManager are left alone. The new updates workflow will propose those updates.

Gates

I ran pnpm typecheck, pnpm lint, pnpm knip, pnpm test, pnpm format:check and pnpm build before each commit. All of them passed, and they also passed on the base commit. Commits 1–3 ran on Node.js 24.22.1 and commit 4 on Node.js 26.12.1. The hooks ran on the last two commits. pnpm build runs no tasks, because no workspace has a build script.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-31T19:49:57.844774Z	9e0f614	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.