Read package.json beside a root pnpm lock pair in hosted mode

The hosted pnpm planner picks which of a root pnpm-lock.yaml /
shrinkwrap.yaml pair to rewrite from the pnpm major the project pins:
node_modules/.modules.yaml, else package.json's packageManager. The
hosted engine only read package.json beside an npm or yarn lock, so on
a fresh clone that pins pnpm 1 or 2 in packageManager (no install
record) hosted rewrote the stray pnpm-lock.yaml while pnpm installs from
shrinkwrap.yaml. Vendored mode and discovery read the pin from disk and
already chose shrinkwrap.yaml. Read the manifest as advisory input
whenever both root pnpm locks are present, so all three agree.

Addresses Bugbot 4500674838 on #2029.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011f9aePC6sLFkqRM2XPWq4P

Author: claude

crates/socket-patch-core/src/hosted/engine.rs

@@ -621,10 +621,17 @@ pub async fn read_candidate_files(
     // and yarn classic rewriters read it as advisory input only: no
     // rewriter edits it, so a link or an unreadable in-memory entry is left
     // out (the rewriters then keep their conservative reading) rather than
-    // refused.
+    // refused. Beside a root `pnpm-lock.yaml` / `shrinkwrap.yaml` pair its
+    // `packageManager` pin decides which of the two pnpm reads
+    // (`formats::pnpm::plan::planned_locks`), as vendored mode and
+    // discovery read it, when no `node_modules/.modules.yaml` records the
+    // installed major (a fresh clone).
     } else if candidates.iter().any(|c| c.dep.ecosystem == "npm")
         && (NPM_LOCKS.iter().any(|lock| out.files.contains_key(*lock))
-            || out.files.contains_key("yarn.lock"))
+            || out.files.contains_key("yarn.lock")
+            || ROOT_PNPM_LOCKS
+                .iter()
+                .all(|lock| out.files.contains_key(*lock)))
     {
         let rel = crate::hosted::memory::select::NPM_MANIFEST_REL;
         if let Some(text) = read_advisory(view, unreadable, rel).await {
@@ -4332,6 +4339,40 @@ mod tests {
         );
     }
 
+    #[tokio::test]
+    async fn a_pnpm_lock_pair_reads_the_package_manager_pin() {
+        // pnpm 2 pinned in package.json, no install record: pnpm reads
+        // shrinkwrap.yaml, so the planner must see the pin to leave the
+        // stray pnpm-lock.yaml alone.
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        let manifest = r#"{"name":"app","packageManager":"pnpm@2.25.7"}"#;
+        std::fs::write(root.join("package.json"), manifest).unwrap();
+        std::fs::write(root.join("pnpm-lock.yaml"), "lockfileVersion: 5.4\n").unwrap();
+        std::fs::write(
+            root.join("shrinkwrap.yaml"),
+            "shrinkwrapMinorVersion: 9\nshrinkwrapVersion: 3\n",
+        )
+        .unwrap();
+        let candidates = vec![left_pad_candidate()];
+        let read =
+            read_candidate_files(&ProjectView::Disk(root), &BTreeSet::new(), &candidates).await;
+        assert_eq!(
+            read.files.get("package.json").map(String::as_str),
+            Some(manifest)
+        );
+        assert_eq!(
+            crate::formats::pnpm::plan::planned_locks(&read.files),
+            vec!["shrinkwrap.yaml"]
+        );
+
+        // One pnpm lock alone governs whatever the pin: no manifest read.
+        std::fs::remove_file(root.join("shrinkwrap.yaml")).unwrap();
+        let read =
+            read_candidate_files(&ProjectView::Disk(root), &BTreeSet::new(), &candidates).await;
+        assert!(!read.files.contains_key("package.json"));
+    }
+
     #[tokio::test]
     async fn issue_490_the_root_manifest_overrides_reach_the_npm_rewriter() {
         let redirected = |done: &Rewritten| {