Prune pnpm env lockfile dependencies

[0x80]

pnpm 12 env documents could disagree with isolated output in two cases. Rush isolates copied config dependency pins that their generated pnpm-workspace.yaml did not declare, while --omit-package-manager removed the manifest pin but left pnpm and executable package records in the lockfile.

Env filtering now follows the declarations retained by the isolate. Rush output drops config pins, package-manager omission drops the pnpm pin, and a reachability walk preserves only package and snapshot records needed by the remaining roots. The walk uses pnpm's dependency-path helpers so peer-qualified snapshots and patched package keys retain the correct records. If filtering removes every env root, the env document is omitted.

The pnpm env-writer asymmetry is tracked upstream in pnpm/pnpm#14322.

Decisions:

• Skip Rush config dependencies instead of copying declarations into generated workspace YAML. Rush output has no source pnpm-workspace.yaml to preserve, so the generated file remains limited to packages and patch metadata.
• Keep the env document unchanged when no pins are removed. Reachability pruning is only needed after the isolate changes its roots.
• Use @pnpm/deps.path for lockfile-key parsing rather than maintaining a local parser for peer and patch suffixes.
• Pin the helper to the latest eligible 1100.x release because 1101.0.0 is inside the repository's seven-day supply-chain cutoff; both versions expose the required path helpers.

Closes #209

Scope: packages (isolate-package)
Visibility: user-facing
Implementer: codex:gpt-5.6-sol:low

[Copilot]

🟡 Changes recommended

Merging independent env root maps can discard a retained pin’s reachable records when package names overlap.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Prunes pnpm 12 env lockfile records to match isolated output, addressing #209 and tracking writer safety in pnpm#14322.

Changes:

• Filters Rush and omitted package-manager pins.
• Prunes package/snapshot graphs via pnpm dependency-path helpers.
• Adds unit and integration coverage.

Problem: Env documents retained undeclared pins and unreachable records.

Root Cause: Env documents were copied without graph pruning.

Solution:

refToRelative(reference, dependencyName)
removePeersSuffix(packageKey)

Benefits: Smaller, consistent isolated lockfiles with peer and patch support.

Testing: Adds focused Vitest unit and integration assertions.

Impact: Improves pnpm 12 and Rush isolation, but overlapping env root names remain mishandled.

File summaries

File	Description
src/lib/lockfile/helpers/generate-pnpm-lockfile.ts	Filters pins and prunes reachable env records.
src/lib/lockfile/helpers/generate-pnpm-lockfile.test.ts	Tests pruning and Rush behavior.
src/lib/lockfile/helpers/generate-pnpm-lockfile.integration.test.ts	Verifies real env output pruning.
package.json	Adds pnpm dependency-path utilities.
pnpm-lock.yaml	Locks the new dependency graph.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

• Files reviewed: 4/5 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.