Fix/qoder managed resource identity (#113)

* fix(sdk): match Qoder managed resources by declared identity during drift detection

- Pass the resource declaration to readComparableResource so adapters can
  use declared display names and metadata for identity.
- Qoder adapter now identifies agents/environments by the protected
  agents.project/agents.resource metadata instead of only by name.
- Treat empty agent descriptions as omitted to avoid phantom drift.
- Update drift-detection and slim-state tests for managed identity behavior.

* chore: add changeset for Qoder managed identity drift fix

* fix(qoder): fix managed resource identity matching during drift detection

- Pass declarations to comparable reads for accurate matching
- Match on protected metadata to ensure correct identity detection
- Update versions of sdk, cli, playground, and server packages to patch 0.7.2/0.0.12
- Reflect fix in changelogs across multiple packages

* fix(deps): upgrade audited dependencies

Raise Tiptap, Hono, and js-yaml to patched releases so the dependency audit can pass.

* fix(deps): keep lockfile registry public

Regenerate the dependency lockfile without local registry URLs so public verification can consume it.

* fix(deps): preserve pinned lockfile resolutions

Retain the existing compatible dependency graph while publishing canonical npm tarball URLs.

Author: heimanba

apps/server/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @openagentpack/server
 
+## 0.0.12
+
+### Patch Changes
+
+- Updated dependencies [fd62da0]
+  - @openagentpack/sdk@0.7.2
+
 ## 0.0.11
 
 ### Patch Changes

apps/server/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@openagentpack/server",
-	"version": "0.0.11",
+	"version": "0.0.12",
 	"private": true,
 	"license": "Apache-2.0",
 	"exports": {
@@ -18,7 +18,7 @@
 		"@hono/zod-openapi": "^1.4.0",
 		"@openagentpack/sdk": "workspace:*",
 		"chokidar": "^4.0.3",
-		"hono": "^4.12.28",
+		"hono": "^4.13.5",
 		"yaml": "^2.9.0"
 	},
 	"devDependencies": {

apps/webui/package.json

@@ -15,14 +15,14 @@
 	"license": "Apache-2.0",
 	"description": "",
 	"dependencies": {
-		"@tiptap/core": "3.30.4",
-		"@tiptap/extension-document": "3.30.4",
-		"@tiptap/extension-mention": "3.30.4",
-		"@tiptap/extension-paragraph": "3.30.4",
-		"@tiptap/extension-text": "3.30.4",
-		"@tiptap/pm": "3.30.4",
-		"@tiptap/react": "3.30.4",
-		"@tiptap/suggestion": "3.30.4",
+		"@tiptap/core": "3.30.5",
+		"@tiptap/extension-document": "3.30.5",
+		"@tiptap/extension-mention": "3.30.5",
+		"@tiptap/extension-paragraph": "3.30.5",
+		"@tiptap/extension-text": "3.30.5",
+		"@tiptap/pm": "3.30.5",
+		"@tiptap/react": "3.30.5",
+		"@tiptap/suggestion": "3.30.5",
 		"i18next": "^25.5.2",
 		"lucide-react": "^1.18.0",
 		"react": "^19.2.7",

bun.lock

@@ -67,17 +67,17 @@
 		"@changesets/cli": "^2.31.0",
 		"@types/bun": "^1.3.14",
 		"dependency-cruiser": "^17.4.3",
-		"js-yaml": "4.3.1",
+		"js-yaml": "4.3.2",
 		"tsup": "^8.5.1",
 		"typescript": "^6.0.3"
 	},
 	"overrides": {
-		"@tiptap/extension-bubble-menu": "3.30.4",
-		"@tiptap/extension-floating-menu": "3.30.4",
+		"@tiptap/extension-bubble-menu": "3.30.5",
+		"@tiptap/extension-floating-menu": "3.30.5",
 		"brace-expansion": "5.0.9",
 		"esbuild": "0.28.1",
 		"fast-equals": "5.3.3",
-		"js-yaml": "4.3.1",
+		"js-yaml": "4.3.2",
 		"nanoid": "3.3.18",
 		"postcss": "8.5.23",
 		"prosemirror-model": "1.25.11"

package.json

@@ -1,5 +1,13 @@
 # @openagentpack/cli
 
+## 0.7.2
+
+### Patch Changes
+
+- fd62da0: Fix Qoder managed resource identity matching during drift detection by passing declarations to comparable reads and matching on protected metadata.
+- Updated dependencies [fd62da0]
+  - @openagentpack/sdk@0.7.2
+
 ## 0.7.1
 
 ### Patch Changes

packages/cli/CHANGELOG.md

@@ -1,6 +1,6 @@
 {
 	"name": "@openagentpack/cli",
-	"version": "0.7.1",
+	"version": "0.7.2",
 	"description": "Open Agent Pack — Declaratively manage AI agent infrastructure",
 	"license": "Apache-2.0",
 	"keywords": [

packages/cli/package.json

@@ -1,5 +1,13 @@
 # @openagentpack/playground
 
+## 0.7.2
+
+### Patch Changes
+
+- fd62da0: Fix Qoder managed resource identity matching during drift detection by passing declarations to comparable reads and matching on protected metadata.
+- Updated dependencies [fd62da0]
+  - @openagentpack/sdk@0.7.2
+
 ## 0.7.1
 
 ### Patch Changes

packages/playground/CHANGELOG.md

@@ -1,6 +1,6 @@
 {
 	"name": "@openagentpack/playground",
-	"version": "0.7.1",
+	"version": "0.7.2",
 	"description": "OpenAgentPack Playground — one-command local web UI for OpenAgentPack",
 	"license": "Apache-2.0",
 	"keywords": [
@@ -44,7 +44,7 @@
 		"@hono/zod-openapi": "^1.4.0",
 		"@openagentpack/sdk": "workspace:*",
 		"chokidar": "^4.0.3",
-		"hono": "^4.12.28",
+		"hono": "^4.13.5",
 		"yaml": "^2.9.0",
 		"zod": "^4.4.3"
 	},

packages/playground/package.json

@@ -1,5 +1,11 @@
 # @openagentpack/sdk
 
+## 0.7.2
+
+### Patch Changes
+
+- fd62da0: Fix Qoder managed resource identity matching during drift detection by passing declarations to comparable reads and matching on protected metadata.
+
 ## 0.7.1
 
 ### Patch Changes