fix(cache): leave noisy fields of pnpm's .modules.yaml out of its fingerprint

[wan9chi]

Motivation

pnpm's node_modules/.modules.yaml is read by every cached vite build and vitest task, because Vite's resolveConfig reads it to extend the dev server's fs.allow (vite-plus#2845). pnpm rewrites prunedAt on fresh installs and records machine-specific paths, so those tasks missed the cache after every reinstall with 'node_modules/.modules.yaml' modified, and could never hit across machines.

Changes

• The manifest is hashed as canonical JSON without the fields that vary with time or with the machine:
  • prunedAt: when pnpm last pruned the virtual store
  • storeDir: absolute path of pnpm's store
  • virtualStoreDir: absolute on Windows; inside the store with pnpm's global virtual store
  • linkedSkills: absolute for skills outside the workspace
• Every other field is still hashed, because tools read them: Nx reads hoistedDependencies, LavaMoat reads pendingBuilds/ignoredBuilds, and which-pm reads packageManager. Whether the file exists is fingerprinted as before.
• The file is parsed as JSON first, then as YAML, since pnpm < 10.29 writes YAML. JSON comes first because it parses about 5× faster, and because the YAML parser rejects keys over 1024 characters, which long dependency paths exceed. Content in neither format is hashed as-is.
• Object keys are sorted before hashing. The serialized bytes are streamed into xxHash3 through a small io::Write adapter, so no intermediate string is built. std::hash::Hash isn't used because its output isn't stable across platforms or Rust versions.
• Redactions live in session/execute/redact/, one module per file, each with a matches condition and a redact action called from hash_file_content.

🤖 Generated with Claude Code

[github-actions]

fspy benchmark

linux

dynamic/launch             change  +0.89%  [ -7.19% .. +12.44%]  overhead   +56.26%
dynamic/access             change  -0.84%  [ -7.20% ..  +6.81%]  overhead    +5.26%
dynamic/access-relative    change  +0.71%  [ -6.50% ..  +6.82%]  overhead   +51.73%
dynamic/access-contended   change  +0.00%  [ -4.06% ..  +3.81%]  overhead   +10.54%
static/launch              change  +2.66%  [ -5.03% .. +10.70%]  overhead  +170.47%
static/access              change  -0.34%  [-15.11% .. +10.66%]  overhead  +765.17%
static/access-relative     change  +0.07%  [ -5.17% ..  +6.73%]  overhead +1022.96%
static/access-contended    change  +1.54%  [ -5.21% ..  +8.04%]  overhead +2480.21%

macos

dynamic/launch             change  +0.45%  [ -2.59% ..  +3.45%]  overhead  +213.73%
dynamic/access             change  -0.36%  [ -2.80% ..  +2.20%]  overhead    +4.32%
dynamic/access-relative    change  -0.22%  [ -3.26% ..  +3.73%]  overhead  +274.61%
dynamic/access-contended   change  +0.47%  [ -4.32% ..  +5.50%]  overhead    +5.95%

windows

dynamic/launch             change  -0.03%  [ -1.90% ..  +2.35%]  overhead   +25.36%
dynamic/access             change  +0.00%  [ -0.59% ..  +0.96%]  overhead    +0.99%
dynamic/access-relative    change  +0.37%  [ -0.92% ..  +0.94%]  overhead    +1.13%
dynamic/access-contended   change  +0.19%  [ -0.56% ..  +1.28%]  overhead    +1.27%