[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #1949
Fixes #1952

Root cause

pnpm 11+ writes an env lockfile (configDependencies / packageManagerDependencies) as a first YAML document ahead of the project lock, and formats::pnpm::grammar::main_document exists to drop it. Several lock readers skip that boundary and walk the whole text with their own line rules:

• PnpmLock::parse feeds the whole text to pnpm_packages and vendored_npm_uuids, so the scan inventory lists config dependencies the install never links, while InstalledPackages and the upstream evidence reader (which call main_document) do not (PnpmLock::parse inventories a pnpm 11 env-lockfile document's configDependencies as project packages, while InstalledPackages and the upstream evidence reader drop it #1949).
• "Does the root lock list a non-root importer?" is answered twice: formats::pnpm::workspace::lock_has_member_importers (hosted, vendored) reads a commented-out # sub: importer as a member, while utils::pnpm_workspace::root_lock_lists_members does not, and neither takes the main document on its own ("pnpm lock importers list a non-root member" is written twice and drifted on comment lines: keep formats::pnpm::workspace, delete the utils::pnpm_workspace copy #1952).

Plan

1. PnpmLock::parse reads main_document(strip_bom(text)) for its entries, vendored uuids and packages: sniff.
2. One importer predicate in formats::pnpm::workspace that takes the lock text, applies main_document and skips comment lines; delete the utils copy and the engine wrapper and route every caller to it.
3. Regression tests: a two-document lock where entries(), InstalledPackages and vendored_npm_uuids agree (PnpmLock::parse inventories a pnpm 11 env-lockfile document's configDependencies as project packages, while InstalledPackages and the upstream evidence reader drop it #1949); a commented-out importer key reads false and env-document importers are ignored ("pnpm lock importers list a non-root member" is written twice and drifted on comment lines: keep formats::pnpm::workspace, delete the utils::pnpm_workspace copy #1952).

Changes (burn-down agent, 48e8e6c)

• PnpmLock::parse keeps only entries starting in main_document(strip_bom(text)) (offsets stay relative to the full text) and reads vendored uuids and the packages: sniff from that document.
• One importer predicate, formats::pnpm::workspace::lock_has_member_importers (comment lines skipped; a column-0 comment no longer ends importers:), plus lock_text_has_member_importers which applies main_document. utils::pnpm_workspace::root_lock_lists_members and the engine's inline wrapper are gone; every caller routes through it.
• Tests: env_document_is_not_in_the_inventory (PnpmLock::parse inventories a pnpm 11 env-lockfile document's configDependencies as project packages, while InstalledPackages and the upstream evidence reader drop it #1949: entries(), resolves(), vendored uuids and InstalledPackages agree; BOM and CRLF twins) and member_importers_skip_comments_and_the_env_document ("pnpm lock importers list a non-root member" is written twice and drifted on comment lines: keep formats::pnpm::workspace, delete the utils::pnpm_workspace copy #1952).

---

Generated by Claude Code

---

Note

Medium Risk
Changes how pnpm lock text is interpreted for inventory and shared-workspace detection; mistakes could mis-report installed or workspace packages, though behavior is aligned with existing main_document callers and covered by new tests.

Overview
pnpm 11+ prepends a separate env YAML document to pnpm-lock.yaml; several readers were walking the full file and disagreeing with code that already used grammar::main_document.

PnpmLock::parse now treats only the project document as the lock inventory: package entries are filtered by offset into that slice, vendored UUID scanning and the packages: sniff use doc, while byte offsets still refer to the full lock text.

Member-importer detection is consolidated: lock_has_member_importers skips # comment lines (so commented-out importers and column-0 comments do not false-positive), and new lock_text_has_member_importers applies main_document before scanning. The duplicate root_lock_lists_members helper and the hosted engine’s inline parsing are removed in favor of that single path.

Regression tests cover env-document packages excluded from entries(), resolves(), vendored usage, and InstalledPackages, plus comment/env-document behavior for shared-lock detection.

^{Reviewed by Cursor Bugbot for commit 48e8e6c. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 48e8e6c. Configure here.}

[Mikola Lysenko (mikolalysenko)]

[burn-down agent] The draft's heartbeat had gone stale (last 22:23Z) and it held only the plan commit, so I implemented the plan in 48e8e6c, marked the PR ready, and labeled it Ready for review.

• CI: 82/82 green on 48e8e6c (32 success, 50 skipped); mergeable.
• Bugbot: reviewed 48e8e6c, no findings.
• Local: cargo test -p socket-patch-core --lib passes except 4 permission tests (copy_tree, vlt_heal, pypi_poetry, pypi_requirements) that fail only because the agent container runs as root. They're unrelated and green in CI.
• Reviewer note: PnpmLock::parse still parses the whole text and keeps entries whose offset is inside main_document, so entry and resolution offsets stay relative to text(). The importer predicate now treats a column-0 # comment as not ending importers: (YAML semantics), which differs from both old copies.
• Slack announcement not sent this run (Slack send unavailable); the next run will retry.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief

What it does: pnpm 11+ writes a two-document pnpm-lock.yaml: an env document (config deps) and then the project lock. PnpmLock::parse now keeps only entries in the project document, so the scan inventory, resolves(), the vendored-uuid set and InstalledPackages agree (#1949). The two "root lock lists member importers" readers become one, lock_text_has_member_importers. It applies main_document and skips comment lines, so a commented-out # sub: no longer counts as a member (#1952).

Risk: low–medium. It changes which packages a pnpm 11 lock reports, but now matches the readers that already used main_document. Offsets still index the full text, which matters to the lock editors. Single-document locks behave as before, apart from the comment-line fix.

Look here

• PnpmLock::parse: filter by doc start offset
• lock_has_member_importers: comment and tab handling
• lock_text_has_member_importers
• SHARED-lock caller switched over
• regression test #1949, BOM and CRLF variants

Verified: read the full diff. Confirmed main_document returns a suffix of its input, so the text.len() - doc.len() offset math holds, BOM case included. Confirmed the vendored caller (vendor/pnpm_lock.rs) already passes only project-document lines. cargo test -p socket-patch-core --lib -- pnpm: 466 pass locally. CI 32 passed / 50 skipped / 0 failed; Bugbot passed.

Changes I made: none.

Open questions: none.

Auto-merge is armed, so approving sends this straight to the merge queue.

---

Generated by Claude Code

[Wenxin Jiang (Wenxin-Jiang)]

[agent] Reviewed 48e8e6c8d9e754086f4d4772a9bf2cb69222d37f. Checked pnpm project-document offsets, environment-document exclusion and importer comments. No major correctness issues found. Validation: source and regression-test review plus the available exact-head CI checks; no local test pass is claimed.