Fix empty patch hash on pnpm 11 lockfiles

[0x80]

pnpm 11 simplified the lockfile patchedDependencies format from Record<string, { path, hash }> to Record<string, string> (selector to hash), and existing lockfiles are migrated automatically. @pnpm/lockfile-file@9 passes this field through unchanged, so reading a pnpm 11 lockfile yields bare hash strings instead of { path, hash } objects.

copyPatches only read originalPatchFile?.hash, which is undefined for a string entry, so the hash ended up empty. That empty hash was written into the isolated lockfile, and pnpm then rejected the isolated install with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH: Cannot proceed with the frozen installation. The current "patchedDependencies" configuration doesn't match the value found in the lockfile.

The hash is now read from either the string (pnpm 11) or the object (pnpm <=10) shape, with the reader's return type widened accordingly. Regression tests cover both formats.

Separately, nested git worktrees under .worktrees/ are now excluded from vitest and oxlint. Git auto-ignores registered worktree paths, but both tools walk the filesystem and were running another branch's tests and linting its files.

Decisions:

• The fix is read-only; the isolated lockfile is still written in the old { path, hash } format by @pnpm/lockfile-file@9. This is intentional: pnpm 11 reads old-format lockfiles, extracts the hash (discarding the path), and respects frozen-lockfile mode while doing so (refactor: simplify patchedDependencies lockfile format pnpm/pnpm#10911), so a correct hash in the old format is accepted. Serializing the new string format would require post-processing YAML the library does not emit, for no functional gain.

Fixes #201

Scope: packages (isolate-package)
Visibility: user-facing

[coderabbitai]

Walkthrough

Updated copyPatches to support pnpm lockfiles that store patched dependency hashes as either bare strings or { path, hash } objects, with tests covering both formats. Expanded Oxlint and Vitest exclusions to ignore nested .worktrees directories.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main fix: preserving patch hashes for pnpm 11 lockfiles.
Description check	✅ Passed	The description accurately explains the pnpm 11 hash issue, the fix, and the added regression tests.
Linked Issues check	✅ Passed	The code now handles both pnpm 11 string and older object formats, preserving the hash as required by #201.
Out of Scope Changes check	✅ Passed	The Vitest and oxlint worktree exclusions are stated in the PR objectives, so no unrelated changes stand out.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 0717-fix-patched-pnpm-11

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

src/lib/patches/copy-patches.test.ts (1)

657-775: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Consider extracting shared test setup.

Both new tests share ~25 lines of nearly identical mock setup (target manifest, readTypedYamlSync, readTypedJson, filterPatchedDependencies, fs.existsSync, usePackageManager). A small helper or beforeEach would reduce duplication and make it easier to add future format variants.

♻️ Suggested shared setup helper

+function mockCopyPatchesCommonDeps() {
+  readTypedYamlSync.mockReturnValue({
+    patchedDependencies: {
+      "lodash@4.17.21": "patches/lodash.patch",
+    },
+  });
+  readTypedJson.mockResolvedValue({
+    name: "root",
+    version: "1.0.0",
+  } as PackageManifest);
+  filterPatchedDependencies.mockReturnValue({
+    "lodash@4.17.21": "patches/lodash.patch",
+  });
+  fs.existsSync.mockReturnValue(true);
+  usePackageManager.mockReturnValue({
+    name: "pnpm",
+    majorVersion: 9,
+    version: "9.0.0",
+    packageManagerString: "pnpm@9.0.0",
+  });
+}
+
 it("should read the patch hash from the pnpm 11 string lockfile format (regression: issue `#201`)", async () => {
   const targetManifest: PackageManifest = {
     name: "test",
     version: "1.0.0",
     dependencies: { lodash: "^4.0.0" },
   };

-  readTypedYamlSync.mockReturnValue({
-    patchedDependencies: {
-      "lodash@4.17.21": "patches/lodash.patch",
-    },
-  });
-  readTypedJson.mockResolvedValue({
-    name: "root",
-    version: "1.0.0",
-  } as PackageManifest);
-
-  filterPatchedDependencies.mockReturnValue({
-    "lodash@4.17.21": "patches/lodash.patch",
-  });
-
-  fs.existsSync.mockReturnValue(true);
-
-  usePackageManager.mockReturnValue({
-    name: "pnpm",
-    majorVersion: 9,
-    version: "9.0.0",
-    packageManagerString: "pnpm@9.0.0",
-  });
+  mockCopyPatchesCommonDeps();

   readWantedLockfile_v9.mockResolvedValue({

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e38407e6-571d-4fcb-9433-51c5485bae71

📥 Commits

Reviewing files that changed from the base of the PR and between 4dea547 and dd41740.

📒 Files selected for processing (4)

• .oxlintrc.json
• src/lib/patches/copy-patches.test.ts
• src/lib/patches/copy-patches.ts
• vitest.config.ts