feat(cli): pin the pnpm store directory for the lockfile prune [RED-931] [ship]

packages/cli/src/ai-context/references/configure-playwright-checks.md

@@ -16,7 +16,7 @@
 - For pnpm projects, the workspace-root pnpmfile (`.pnpmfile.cjs` / `.pnpmfile.mjs`) is bundled automatically so the remote install can reproduce the lockfile — but only when the lockfile records a pnpmfile checksum (run `pnpm install` with the pnpmfile in place to record one; without it the pnpmfile is silently not bundled). The pnpmfile must also be self-contained: it may only load side-effect-free Node.js builtins (such as `path`, `crypto`, `util`) via literal `require('...')`/`import` specifiers, and must not reference `process`, `__dirname`, `import.meta`, or dynamically computed module paths. A pnpmfile that is not self-contained is skipped with a warning, and the remote install may re-resolve dependencies instead of using the lockfile. The pnpmfile is uploaded, so avoid embedding secrets in it.
 - In a workspace (monorepo) whose code bundle covers only part of the workspace, the bundled lockfile is pruned automatically so the remote install only fetches what the bundle needs, instead of failing on dependencies of workspace members that were left out.
   - Supported for `pnpm-lock.yaml` (v6/9), `package-lock.json` (v2/3), the text `bun.lock`, and Yarn Berry `yarn.lock`. Yarn Classic v1 lockfiles are not supported; for bun's binary `bun.lockb`, regenerate a text lockfile with `bun install --save-text-lockfile`.
-  - The workspace's package manager binary must be available on the machine running the CLI. For pnpm and npm, pruning reuses cached registry metadata and only contacts the registry for packages missing from the cache; yarn Berry and bun regenerate offline.
+  - The workspace's package manager binary must be available on the machine running the CLI. pnpm resolves against the workspace's own store plus cached registry metadata, npm reuses its cached metadata, and both only contact the registry for misses; yarn Berry and bun regenerate offline.
   - When pruning was needed but cannot run or cannot verify its result, the original lockfile ships unchanged and the CLI prints a note explaining why — follow it (a timed-out prune's note names `CHECKLY_LOCKFILE_PRUNE_TIMEOUT=<seconds>`, which raises the default 30 s budget). Skips are silent when there is nothing to prune, or when pruning is disabled via `CHECKLY_LOCKFILE_PRUNE=0`; silent skip reasons, a timed-out prune's partial package manager output, and per-entry embed match details are visible under `DEBUG='checkly:cli:services:check-parser:*'` and `DEBUG='checkly:cli:services:embedded-packages'`.
   - For pnpm projects with `patchedDependencies`, patches belonging to unbundled workspace members are filtered out automatically. A note naming stale patch declarations means the lockfile is out of date with the config — refresh it with a regular install.
 - Checkly caches installed dependencies between runs, keyed off the workspace's dependency inputs (the lock file, every workspace member's `package.json` and `.npmrc` — whether or not the member is in the bundle) plus the bundle's own install inputs, so the key can change without a file edit, e.g. when a different set of workspace members lands in the bundle. To force a reinstall for deployed checks, set `runner.cache.install.version` (a string or a safe integer) at the top level of `checkly.config.ts` — not per check — and change its value whenever the cache should be invalidated; deployed, scheduled checks pick up the change on the next `checkly deploy`. If the config still declares the deprecated `caching.dependencyCache.version`, remove it — setting both fails config loading. Unset or empty values leave the cache key unchanged, so a dynamic value such as `version: process.env.DEPENDENCY_CACHE_VERSION` is safe when the variable is not always set. For a one-off reinstall during an ad-hoc run, use the `--refresh-cache` flag on `checkly test`, `checkly pw-test`, `checkly trigger`, or `checkly checks run` instead.

packages/cli/src/services/check-parser/__tests__/bundler.spec.ts

@@ -527,6 +527,7 @@ describe('Bundler.finalize() embedded package materialization', () => {
     ].join('\n'))
     return Object.assign(Object.create(new PNpmDetector()), {
       lockfileOnlyInstallCommand: () => new Runnable('node', [scriptPath]),
+      storeDirCommand: () => undefined,
     })
   }
 
@@ -833,6 +834,7 @@ describe('Bundler.finalize() patch filtering', () => {
     ].join('\n'))
     return Object.assign(Object.create(new PNpmDetector()), {
       lockfileOnlyInstallCommand: () => new Runnable('node', [scriptPath]),
+      storeDirCommand: () => undefined,
     })
   }
 
@@ -1231,6 +1233,7 @@ describe('Bundler.finalize() package pruning', () => {
     await fs.writeFile(scriptPath, lines.join('\n'))
     return Object.assign(Object.create(new PNpmDetector()), {
       lockfileOnlyInstallCommand: () => new Runnable('node', [scriptPath]),
+      storeDirCommand: () => undefined,
     })
   }