Fix turbo gen bundler resolution by externalizing npm package dependencies

[Copilot]

Turbo gen's internal bundler fails to resolve hosted-git-info and validate-npm-package-name imports in config.ts, causing pnpm generate "copy plugin" to fail with ResolveMessage: Cannot find package errors.

Changes

• Created external helper scripts that bypass turbo's bundling:

  • turbo/generators/scripts/validate-package-name.cjs - npm package name validation
  • turbo/generators/scripts/parse-repo-url.cjs - git repository URL parsing

• Modified config.ts to call helpers via execSync() instead of direct imports:

  // Before: import validateNpmPackageName from 'validate-npm-package-name'
  // After:
  function validatePackageName(name: string): {errors?: string[]} {
    const scriptPath = join(__dirname, 'scripts/validate-package-name.cjs')
    execSync(`node "${scriptPath}" "${name}"`, {encoding: 'utf-8', stdio: 'pipe'})
    return {}
  }

• Upgraded turbo from 2.8.2 to 2.8.8

Helper scripts use .cjs extension to avoid ES module conflicts with root package.json "type": "module".

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• sanity-cdn.com
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/plugins/plugins/dev/test-studio/node_modules/.bin/../sanity/bin/sanity build (dns block)
• turbo.build
  • Triggering command: /usr/bin/curl curl -s REDACTED git dule�� HEAD (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 43d6305

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
plugins-studio	Ready	Preview, Comment	Feb 17, 2026 7:12am

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​turbo/​gen@​2.8.2 ⏵ 2.8.8			-26
	npm/​turbo@​2.8.2 ⏵ 2.8.8				+1

View full report