Walkthrough

Adds an opt-in config flag smartAutoDedupe (disabled by default). When enabled, the resolver runs a post-resolution pass that rewrites parent→child edges to higher in-graph versions that satisfy the original semver spec and share compatible peer/patch metadata, then prunes orphaned snapshots.

Changes

Smart Auto-Dedupe

Sequence Diagram

sequenceDiagram
  participant User
  participant Install as Install<br/>Handler
  participant Resolver as Dependency<br/>Resolver
  participant SmartDedupe as Smart<br/>Auto-Dedupe
  participant Graph as Dependency<br/>Graph

  User->>Install: run install with smartAutoDedupe=true
  Install->>Resolver: resolveDependencies(opts)
  Resolver->>Graph: build dependency graph
  Graph-->>Resolver: graph built
  alt smartAutoDedupe enabled
    Resolver->>SmartDedupe: applySmartAutoDedupe(graph)
    SmartDedupe->>SmartDedupe: group nodes by name, peer-hash, patch-hash
    SmartDedupe->>SmartDedupe: find higher in-graph versions satisfying spec
    SmartDedupe->>Graph: rewrite edges and prune orphaned snapshots
    Graph-->>SmartDedupe: updated graph
    SmartDedupe-->>Resolver: void (in-place)
  end
  Resolver-->>Install: resolved packages
  Install-->>User: install complete

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Suggested reviewers

• zkochan

❌ Failed checks (1 warning)

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

• X
• Mastodon
• Reddit
• LinkedIn

Description

applySmartAutoDedupe rewrites parent→child edges but never recomputes the target node’s reachability
flags (notably optional), so a node that was previously optional-only can become required while
still being recorded as optional. This optional bit is serialized into the lockfile and can cause
required packages’ fetch/install failures to be incorrectly ignored in later restore/hoisted flows.

Code

installing/deps-resolver/src/smartAutoDedupe.ts[R122-138]

+  for (const parentDepPath of Object.keys(graph) as DepPath[]) {
+    const parent = graph[parentDepPath]
+    if (parent.depSpecs == null) continue
+    for (const [alias, childDepPath] of Object.entries(parent.children)) {
+      const child = graph[childDepPath]
+      if (child == null || !child.name || !child.version) continue
+      if (!isDedupableResolution(child.resolution)) continue
+      const { version, peerDepGraphHash = '', patchHash = '' } = parseDepPath(childDepPath)
+      if (version == null) continue
+      const bucket = candidates.get(child.name)?.get(peerDepGraphHash)?.get(patchHash)
+      if (bucket == null) continue
+      const spec = normalizeRange(parent.depSpecs[alias])
+      if (spec == null) continue
+      const upgrade = findUpgrade(bucket, child.version, spec)
+      if (upgrade != null && upgrade !== childDepPath) {
+        parent.children[alias] = upgrade
+      }

Evidence

The smart dedupe pass mutates only parent.children, while optional is computed earlier during
resolution and later persisted to the lockfile; downstream restore logic treats snapshots with
optional: true as ignorable on fetch failure, so stale optional metadata can suppress errors for
required packages.

installing/deps-resolver/src/smartAutoDedupe.ts[122-139]
installing/deps-resolver/src/resolveDependencies.ts[1946-1998]
installing/deps-resolver/src/updateLockfile.ts[26-47]
installing/deps-resolver/src/updateLockfile.ts[116-118]
installing/deps-restorer/src/lockfileToHoistedDepGraph.ts[249-262]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`applySmartAutoDedupe()` mutates `parent.children` to point at an upgraded depPath, but does not update the upgraded node’s `optional` (and other reachability) flags to reflect its new required usage. This can persist incorrect `optional: true` into `pnpm-lock.yaml`, which downstream install/restore code uses to decide whether to ignore failures.
## Issue Context
- A node’s `optional` flag is computed during resolution based on whether it is reached via an optional chain, and is tightened on reuse via `optional = optional && currentIsOptional`.
- After the smart dedupe pass, required edges may now point at a node that was previously only reached via optional paths.
- `updateLockfile()` serializes `pkg.optional` into the snapshot’s `optional` field, and restore/hoist code can ignore fetch errors for snapshots marked optional.
## Fix Focus Areas
- installing/deps-resolver/src/smartAutoDedupe.ts[122-140]
- installing/deps-resolver/src/resolveDependencies.ts[1946-1998]
- installing/deps-resolver/src/updateLockfile.ts[26-47]
- installing/deps-resolver/src/updateLockfile.ts[116-118]
- installing/deps-restorer/src/lockfileToHoistedDepGraph.ts[249-262]
## Suggested fix approach
1. When rewriting an edge, determine whether the edge is optional under pnpm’s semantics (e.g. `edgeOptional = parent.optional || parent.optionalDependencies.has(alias) || parent.peerDependencies[alias]?.optional === true`).
2. If `edgeOptional` is false, ensure the upgraded node and its transitively-required children are marked non-optional:
- Set `graph[upgrade].optional = false`.
- Propagate this requirement down the dependency tree: for each required (non-optional) node, walk its `children` and for each child reached via a non-optional edge, set `child.optional = false` and continue.
- (If you also need prod/dev correctness, consider similarly updating `prod/dev` flags, but the critical correctness bug here is `optional`.)
3. Add/extend a test that constructs a graph where the higher in-graph version is initially optional-only and becomes the rewrite target of a non-optional edge, asserting the resulting lockfile snapshot is not marked `optional` and that failures are not suppressed.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)