Switch front-end from yarn to pnpm; volta to vite-plus

[andrew-polk]

Dependency-risk hardening: move all four JS projects (BloomBrowserUI,
content, BloomVisualRegressionTests, component-tester) from yarn 1 to
pnpm 11.5.2, each installed independently with its own pnpm-lock.yaml.
Per-project policy in pnpm-workspace.yaml:

• minimumReleaseAge 10080: refuse versions published less than 7 days
  ago, so a freshly-compromised release can't be pulled in immediately.
• Exact version pins carried over from the old yarn.lock files.
• allowBuilds: postinstall scripts run only for esbuild.

Toolchain: replace volta with vite-plus (vp); packageManager pnpm@11.5.2
and .node-version (22.21.1) at the repo root and each project.

Git hooks: husky v4 is EOL and incompatible with pnpm. Hooks are now
installed by scripts/setup-git-hooks.mjs (BloomBrowserUI's "prepare"
script), which points core.hooksPath at the shared .githooks dispatcher;
the pre-commit logic lives in src/BloomBrowserUI/.vite-hooks/pre-commit
and still runs pretty-quick, lint-staged, typecheck, and the C# checks
using the project's own pinned tools. See .githooks/README.md.

BloomBrowserUI specifics:

• yarn "resolutions" -> pnpm "overrides" (@types/react dedupe to 18).
• Dropped patch-package; patches applied via pnpm patchedDependencies.
• Rewrote yarn commands to pnpm in scripts, docs, and comments.

Also removed yarn.lock/.yarnrc.yml/old .npmrc, updated docs, init.sh,
.vscode configs, and the PR-automation workflow (now npm).

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com
Co-Authored-By: Claude Fable 5 noreply@anthropic.com

Devin review

---

This change is 

[greptile-apps]

Greptile Summary

This PR migrates all four JS projects from yarn 1 to pnpm 11.5.2 and replaces Volta with vite-plus (vp) for toolchain management, implementing supply-chain hardening via minimumReleaseAge: 10080 (7-day embargo on freshly-published versions), exact version pins, and an explicit allowBuilds allowlist. The husky v4 git hooks are replaced by a custom transitional dispatcher in .githooks/ that routes to the correct hook system based on which branch is checked out.

• Dependency hardening: all four projects now pin exact versions, set minimumReleaseAge: 10080, and gate build-script execution via the pnpm v11 allowBuilds map — both true (esbuild binary install) and false (benign postinstalls explicitly acknowledged) entries are intentionally present.
• Hook migration: husky v4 (EOL, incompatible with pnpm) is replaced by scripts/setup-git-hooks.mjs (run as the prepare script), which sets core.hooksPath → .githooks; the dispatcher there routes to .vite-hooks/pre-commit on pnpm branches or to the husky hook on legacy branches for backward compatibility.
• Patch migration: patch-package is dropped in favour of pnpm's native patchedDependencies; the two existing patches (react-collapse-pane, react-lazyload) are carried over in standard git-diff format.

Important Files Changed

Filename	Overview
src/BloomBrowserUI/pnpm-workspace.yaml	New pnpm v11 workspace config: minimumReleaseAge, exact version saves, overrides (formerly yarn resolutions), patchedDependencies, and the allowBuilds map with correct true/false semantics.
src/BloomBrowserUI/package.json	Migrated from yarn to pnpm: removed husky/patch-package, added prepare script for git hooks, converted all deps to exact pins, swapped bloom-image-gallery to explicit github: prefix, removed volta field.
src/BloomBrowserUI/.vite-hooks/pre-commit	New pre-commit hook replacing husky; correctly prepends node_modules/.bin to PATH from repo root, CDs into the front-end project, then CDs back for C# checks.
src/BloomBrowserUI/scripts/setup-git-hooks.mjs	New prepare-script hook installer; sets core.hooksPath to .githooks repo-wide, removes any worktree-scoped override, guards silently in non-git environments.
.github/workflows/pr-automation.yml	Switched from yarn add playwright-core to npm install playwright-core; correctly documented as intentional since the job runs without a repo checkout where pnpm policy does not apply.
src/BloomBrowserUI/react_components/component-tester/pnpm-workspace.yaml	Correctly marks component-tester as an independent pnpm root (separate from BloomBrowserUI install) with matching security policies.
src/content/pnpm-workspace.yaml	Correct pnpm v11 policy for the content build; only core-js: false in allowBuilds since content uses less/pug/ts-node and does not need esbuild.
src/BloomVisualRegressionTests/pnpm-workspace.yaml	Correct pnpm v11 policy for visual regression tests; esbuild: true needed since vitest pulls in esbuild for bundling.
.gitignore	Removed yarn-specific ignores, added global pnpm-debug.log* ignore. pnpm-lock.yaml files are NOT ignored, which is correct.
init.sh	Correctly updated to use pnpm install and pnpm run build in the parallel init script.

_{Reviews (6): Last reviewed commit: "Fix yarn reference in dismissProblemDial..." | Re-trigger Greptile}

[andrew-polk]

[Devin] Investigate: Visual regression tests package also migrated but with an added dependency

The @argos-ci/cli package (src/BloomVisualRegressionTests/package.json:12) was added as a new devDependency in the visual regression tests. The upload script changed from npm exec argos upload to pnpm exec argos upload — but npm exec would have been resolving argos from somewhere (possibly a global install or npx-style download). Adding @argos-ci/cli as an explicit devDependency ensures it's available locally, which is more reliable. Worth confirming this is the correct package for the argos upload command.

---

Verified during preflight: @argos-ci/cli@6.0.0 is the official Argos CLI package that provides the argos binary (argos upload), and the script is pnpm exec argos upload ./screenshots. Making it an explicit devDependency is the correct fix (previously it was resolved implicitly). No action required unless you want a different Argos package.

— mirrored by Claude Opus 4.8 (preflight)

[andrew-polk]

[Claude Opus 4.8 / preflight] Decision: leaving this as is — no change needed. Verified during preflight that @argos-ci/cli@6.0.0 is the official Argos CLI providing the argos binary used by pnpm exec argos upload, so making it an explicit devDependency is correct (previously resolved implicitly). Greptile and the local review agreed. Thread intentionally left unresolved so a human reviewer can give it a final glance.

[andrew-polk]

[Claude Opus 4.8 / preflight] Consulted Devin on 2026-07-08 16:54 UTC up to commit 1230beb46ac70afb31da262c0de097d21085e70f. Result: 0 bugs (1 previously-resolved, never posted), 1 Investigate flag (mirrored as an inline thread and verified OK during preflight), 7 Informational (skipped).

[StephenMcConnel]

A couple of minor questions is all I found.

@StephenMcConnel partially reviewed 79 files and all commit messages, and made 3 comments.
Reviewable status: all files reviewed, 3 unresolved discussions (waiting on andrew-polk).

---

ReadMe.md line 49 at r1 (raw file):

For fast hot-reloading, first do one pnpm build, to get all the (so-far) static assets. Then run pnpm dev. Currently only some parts of the Bloom UI benefit from this (the ones implemented using ReactControl, including ReactDialog). You may need to run pnpm watch in another terminal.

It may be helpful before submitting a PR to turn off pnpm dev and run pnpm build, then do a quick smoke test of your work. pnpm build creates the transpiled files that will be used by Bloom in production.

Is worth mentioning the /preflight skill here?

---

.github/workflows/pr-automation.yml line 46 at r1 (raw file):

              run: |
                  npm init -y
                  npm install playwright-core

Should these be pnpm instead of npm? If not, maybe a comment is in order. Maybe just installing something doesn't matter in this context.

[andrew-polk]

@andrew-polk+AI made 2 comments.
Reviewable status: 76 of 79 files reviewed, 3 unresolved discussions (waiting on andrew-polk and StephenMcConnel).

---

ReadMe.md line 49 at r1 (raw file):

Previously, StephenMcConnel (Steve McConnel) wrote…

Is worth mentioning the /preflight skill here?

[Claude Fable 5] Good idea - done in 5149ca1: that paragraph now points at the team /preflight skill (with a pointer to the Skills section of AGENTS.md for installing the team skills).

---

.github/workflows/pr-automation.yml line 46 at r1 (raw file):

Previously, StephenMcConnel (Steve McConnel) wrote…

Should these be pnpm instead of npm? If not, maybe a comment is in order. Maybe just installing something doesn't matter in this context.

[Claude Fable 5] npm is deliberate here, and 5149ca1 adds a comment in the workflow saying why: this job runs without a repo checkout, so the repo pnpm policy doesn't apply; it only needs playwright-core in a throwaway directory on the runner, and npm is preinstalled there (pnpm would need an extra setup step for no benefit).

[andrew-polk]

[Claude Fable 5 / preflight] Consulted Devin on 2026-07-09 20:50 UTC up to commit c40cbc52119aa5ea072ab157e0ec7bd165d74969. Result: 0 bugs (2 Resolved: the dismissProblemDialog.mjs yarn message it found on the previous commit and we fixed in c40cbc5, and the earlier npm upload script — neither ever posted as a thread), 1 Investigate flag (the @argos-ci/cli thread, already mirrored and answered on 2026-07-08), 6 Informational (skipped). Re-review clean.

[andrew-polk]

@andrew-polk made 2 comments and resolved 1 discussion.
Reviewable status: 76 of 80 files reviewed, 2 unresolved discussions (waiting on andrew-polk and StephenMcConnel).

---

ReadMe.md line 49 at r1 (raw file):

Previously, andrew-polk+AI (Agent AI for andrew-polk) wrote…

[Claude Fable 5] Good idea - done in 5149ca1: that paragraph now points at the team /preflight skill (with a pointer to the Skills section of AGENTS.md for installing the team skills).

Done.

---

.github/workflows/pr-automation.yml line 46 at r1 (raw file):

Previously, andrew-polk+AI (Agent AI for andrew-polk) wrote…

[Claude Fable 5] npm is deliberate here, and 5149ca1 adds a comment in the workflow saying why: this job runs without a repo checkout, so the repo pnpm policy doesn't apply; it only needs playwright-core in a throwaway directory on the runner, and npm is preinstalled there (pnpm would need an extra setup step for no benefit).

Done.

[StephenMcConnel]

@StephenMcConnel reviewed 4 files and all commit messages, and resolved 2 discussions.
Reviewable status: complete! all files reviewed, all discussions resolved (waiting on andrew-polk).