fix: remove .pnpmrc, a config file pnpm never reads

[jakero]

Summary

.pnpmrc has never affected pnpm behavior, so this removes it. No functional change.

pnpm resolves configuration from CLI flags, environment variables, pnpm-workspace.yaml, and .npmrc (auth/registry only as of pnpm 12). No pnpm release reads a .pnpmrc. The file was added 2025-08-26 and has never been modified since.

-strict-peer-dependencies=false
-node-linker=hoisted
-auto-install-peers=true

Two of those three lines were already pnpm defaults (strict-peer-dependencies defaults to false, auto-install-peers to true since pnpm 8), so the only line with any potential effect was node-linker=hoisted.

Why the file does nothing

Verified on pnpm 10.26.2, the version pinned in packageManager, by installing a probe project four ways and reading the resulting node_modules/.modules.yaml:

Config file	Effective nodeLinker
(none)	isolated
.npmrc	hoisted
.pnpmrc	isolated (ignored)
pnpm-workspace.yaml	hoisted

The same A/B run against this repository, wiping node_modules and reinstalling for each case, produces isolated both with and without the file.

How it got here

• 2b45a1f (2025-08-26 15:10) — npm → pnpm migration. Creates pnpm-workspace.yaml with onlyBuiltDependencies, i.e. the correct pnpm-native config file was already known here.
• e805f93 (same day, 15:30) — removes the package-manager lock from package.json#engines ("npm": "please-use-pnpm", "yarn": "please-use-pnpm", "pnpm": ">=10.0.0") and creates .pnpmrc with node-linker=hoisted. Since the PM lock was being loosened, making pnpm produce an npm-like flat layout was a reasonable goal; the filename was inferred from the .npmrc / .yarnrc convention rather than from pnpm's docs.
• c68daf6 (5 days later) — upgrades sharp 0.33 → 0.34 and creates .npmrc containing shamefully-hoist=true, which is the same intent and does take effect. This is where the setting actually landed. .pnpmrc was left in place.
• a032ece (2025-12-25) — removes shamefully-hoist=true from .npmrc. From this point every surface runs pnpm's default isolated layout, with no regressions.

So the file has been inert for its entire ~13-month lifetime, and the project has been on isolated in CI since 2025-12-25.

Nothing references it

• No matches in code, documentation, workflows, or llms.txt
• Absent from the published tarball (package.json#files whitelist, 119 entries)
• Never deleted or modified since it was added

Why removal is safe

Every surface already resolves to isolated, i.e. the layout CI and Docker have been using all along:

• .github/actions/setup-env/action.yml and npm-publish.yml run pnpm install --frozen-lockfile with no linker override
• Dockerfile copies only package.json and pnpm-lock.yaml before installing, so no config file is present in the image at that layer
• bin/utils/build-workspace.ts copies only package.json, pnpm-lock.yaml, package-lock.json, and the rust-toolchain files into the private build workspace, so end-user Tauri dependency installs never see this file either
• pnpm-lock.yaml is unchanged by this PR

package.json is untouched, so the tracked dist/cli.js needs no rebuild.

Verification

node scripts/check-release-version.mjs     -> Release version check passed for V3.17.2
pnpm run cli:build                          -> exit 0
git diff --exit-code -- dist/cli.js         -> exit 0 (byte-identical to committed)
git diff --exit-code -- pnpm-lock.yaml      -> exit 0
PAKE_CREATE_APP=1 node tests/index.js --no-build -> 14/15
npx vitest run                              -> 492 passed | 3 skipped | 2 failed
node dist/cli.js --version                  -> 3.17.2
npm pack --dry-run --ignore-scripts         -> 119 files (unchanged)

The 2 vitest failures are tests/unit/local-staging.test.ts requiring fs.symlinkSync, which returns EPERM on a Windows machine without Developer Mode. They fail identically on main with .pnpmrc restored — verified by re-running the same suite on main:

main     (baseline) : 1 failed | 52 passed (53) | 2 failed | 492 passed | 3 skipped (497)
this PR            : 1 failed | 52 passed (53) | 2 failed | 492 passed | 3 skipped (497)

Note for reviewers

This is a deletion with no behavior change, so the only question is whether the setting was wanted. If a flat node_modules is genuinely required, the correct place is pnpm-workspace.yaml (.npmrc also works on pnpm 10, but pnpm 12 reads only auth/registry from it). I did not add that file here because nothing currently depends on hoisting: the repository has zero undeclared root-level imports across 99 source files, and pendingBuilds is identical under both layouts.

Note on local verification on Windows

pnpm run release:check cannot complete on a Windows checkout for reasons unrelated to this change: .gitattributes sets no text/eol rules, so core.autocrlf=true checks files out as CRLF while .editorconfig declares end_of_line = lf and Prettier enforces it, failing format:check on 152 files. The gates above were therefore run individually.

[tw93]

@jakero Thanks for checking this against the pinned pnpm version. It is merged and included in pake-cli 3.17.3; install behavior stays the same, since pnpm never read that file.