Consolidate pnpm lockfile reading

[0x80]

Three modules selected the pnpm v8 or v9 lockfile reader independently, which duplicated the version boundary and reader options while leaving failure behavior implicit at each call site.

A shared readPnpmLockfile module now owns reader selection, the ignoreIncompatible option, the package-alias explanation, and the failure contract. Lockfile generation uses the default throwing policy. Installed-name collection and patch copying retain read errors so each can preserve its existing fallback or user-facing diagnostic. Tests cover both reader branches, missing lockfiles, forwarded options, thrown errors, retained errors, and each consumer's chosen policy.

Local verification and CI passed typecheck, lint, formatting, all 330 tests, and the production build. Three local review phases found and fixed failure-policy, diagnostic, and mock-fidelity gaps before handoff. Copilot completed its review without comments.

Decisions:

• Keep Rush-aware directory resolution in getPnpmLockfileDir, as established by pnpm 12 writes a two-document pnpm-lock.yaml that isolate cannot read #205. The new module accepts the resolved directory and owns only lockfile reading.
• Retain read errors instead of returning undefined for tolerant consumers. Installed-name collection needs the error for debug diagnostics, while patch copying includes it in an actionable failure.
• Leave the existing writer-only compatibility cast in generate-pnpm-lockfile.ts. The reader union does not need a cast, so moving the writer cast would broaden this reader-focused change.

Closes #208

Scope: packages (isolate-package)
Visibility: internal
Implementer: codex:gpt-5.6-sol:low

[Copilot]

🟢 Approval recommended

The centralized behavior is consistent with existing callers and has focused coverage for both reader branches and failure policies.

Pull request overview

Consolidates pnpm v8/v9 lockfile reading behind a shared helper, completing the follow-up from #205 tracked by #208.

Problem: Three consumers duplicated reader selection and failure handling.

Root Cause: The version boundary and reader options lacked a shared abstraction.

Solution:

readPnpmLockfile(directory, majorVersion, { onFailure: "return-error" });

Benefits:

• Centralized reader selection and compatibility documentation.
• Explicit throwing or error-retaining policies.
• Preserved Rush-aware lockfile resolution.

Testing: Adds focused Vitest coverage for reader versions, options, missing files, and failures; the PR reports all 330 tests and build checks passing.

Impact: Maintains existing consumer behavior while reducing duplicated pnpm compatibility logic.

File summaries

File	Description
src/lib/lockfile/read-pnpm-lockfile.ts	Adds the shared reader and failure contract.
src/lib/lockfile/read-pnpm-lockfile.test.ts	Tests dispatch and error policies.
src/lib/lockfile/helpers/generate-pnpm-lockfile.ts	Uses the shared throwing reader.
src/lib/lockfile/helpers/generate-pnpm-lockfile.test.ts	Verifies read-error propagation.
src/lib/patches/copy-patches.ts	Retains errors for patch diagnostics.
src/lib/patches/collect-installed-names-pnpm.ts	Preserves fallback behavior with diagnostics.
src/lib/patches/collect-installed-names-pnpm.test.ts	Verifies retained-error logging.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.