fix: pnpm review follow-ups in nix, evals, the hang repro and an e2e test

- nix dev shell: pnpm-workspace.yaml (overrides, catalog, allowBuilds)
  joins the package.json stamp, so a settings-only change relocks.
- desktop-pane-fixture: resolve vitest/config from apps/desktop; pnpm
  links it only there.
- short-session hang repro: name the lockfile in the target metadata, so
  an npm-era target fails as a lockfile mismatch rather than a bare hash.
- test_mirrors: the pnpm mirror test prefetches from the registry and
  needs allow_network, like its siblings.

apps/desktop/scripts/run-short-session-hang-repro.mjs

@@ -224,12 +224,16 @@ function resolveRef(rawRef) {
 }
 
 function readTargetMetadata(sha) {
-  // Targets older than the pnpm switch carry npm's lockfile instead.
+  // Targets older than the pnpm switch carry npm's lockfile instead. Both targets run on
+  // the harness checkout's install, which no npm lock can be shown to match: name the
+  // lockfile so that mismatch reads as one.
+  let lockfile = 'pnpm-lock.yaml'
   let lock
   try {
-    lock = run('git', ['show', '--end-of-options', `${sha}:pnpm-lock.yaml`])
+    lock = run('git', ['show', '--end-of-options', `${sha}:${lockfile}`])
   } catch {
-    lock = run('git', ['show', '--end-of-options', `${sha}:package-lock.json`])
+    lockfile = 'package-lock.json'
+    lock = run('git', ['show', '--end-of-options', `${sha}:${lockfile}`])
   }
   const pyproject = run('git', ['show', '--end-of-options', `${sha}:pyproject.toml`])
   const uvLock = run('git', ['show', '--end-of-options', `${sha}:uv.lock`])
@@ -238,6 +242,7 @@ function readTargetMetadata(sha) {
   return {
     electron: pkg.devDependencies?.electron,
     electronBuild: pkg.build?.electronVersion,
+    lockfile,
     lockSha256: sha256(lock),
     pyprojectSha256: sha256(pyproject),
     uvLockSha256: sha256(uvLock)

evals/desktop-pane-fixture/vitest.config.mts

@@ -1,6 +1,11 @@
 // From apps/desktop: pnpm exec vitest run --config ../../evals/desktop-pane-fixture/vitest.config.mts
 // Replay a slow module evaluation without changing any pane behavior or deadlines.
-import { defineConfig, mergeConfig } from 'vitest/config'
+import { createRequire } from 'node:module'
+
+// pnpm links vitest only into apps/desktop, so resolve it from there, not from this directory.
+const { defineConfig, mergeConfig } = createRequire(new URL('../../apps/desktop/package.json', import.meta.url))(
+  'vitest/config'
+) as typeof import('vitest/config')
 
 import desktopConfig from '../../apps/desktop/vite.config.ts'
 

nix/lib.nix

@@ -13,7 +13,7 @@
 #
 # buildPnpmPackage returns packageJsonPath (e.g. "ui-tui/package.json")
 # instead of a per-package devShellHook.  The root devshell hook
-# (mkPnpmDevShellHook) collects all package.json paths, stamps them,
+# (mkPnpmDevShellHook) stamps all package.json paths and pnpm-workspace.yaml,
 # and if any changed, runs a single `pnpm install --lockfile-only` from
 # root to update the lockfile, then `pnpm install --frozen-lockfile` if
 # the lockfile changed.
@@ -387,11 +387,12 @@ in
     writeShellScript "pnpm-dev-hook" ''
       REPO_ROOT=$(git rev-parse --show-toplevel)
 
-      # Stamp all workspace package.jsons into one file.
+      # Stamp all workspace package.jsons, and pnpm-workspace.yaml (its
+      # overrides, catalog and allowBuilds shape the lock too), into one file.
       STAMP_DIR=".nix-stamps"
       STAMP="$STAMP_DIR/npm-package-jsons"
       STAMP_VALUE=$(
-        ${coreutils}/bin/sha256sum ${
+        ${coreutils}/bin/sha256sum "$REPO_ROOT/pnpm-workspace.yaml" ${
           lib.concatMapStringsSep " " (p: "\"$REPO_ROOT/${p}\"") packageJsonPaths
         } 2>/dev/null | ${coreutils}/bin/sort | ${coreutils}/bin/sha256sum | awk '{print $1}'
       )
@@ -399,7 +400,7 @@ in
       PKG_CHANGED=false
       if [ ! -f "$STAMP" ] || [ "$(cat "$STAMP")" != "$STAMP_VALUE" ]; then
         PKG_CHANGED=true
-        echo "pnpm: package.json changed, updating lockfile..."
+        echo "pnpm: package.json or pnpm-workspace.yaml changed, updating lockfile..."
         ( cd "$REPO_ROOT" && ${lib.getExe' pnpm "pnpm"} install --lockfile-only --silent 2>/dev/null )
         mkdir -p "$STAMP_DIR"
         echo "$STAMP_VALUE" > "$STAMP"

tests/e2e/core/upgrade/network/test_mirrors.py

@@ -112,6 +112,7 @@ def test_npm_registry_mirror_serves_pm_npm_download(inst):
         npmrc.unlink()
 
 
+@pytest.mark.allow_network  # S.prefetch seeds the mirror with the pinned pnpm tarballs
 def test_npm_registry_mirror_serves_both_pm_pnpm_downloads(inst):
     """pnpm is two npm-hosted archives (the native executable, then the launcher whose dist/ it
     needs): with ``~/.npmrc`` naming the mirror, `hermes pm install pnpm` fetches both from it,