fix: don't link to Node.js executables that are not managed by pnpm (#3910)

close #3905

.changeset/quiet-teachers-dance.md

@@ -0,0 +1,5 @@
+---
+"@pnpm/plugin-commands-installation": patch
+---
+
+Do not explicitly link to Node.js executables that are not in the pnpm home directory.

packages/plugin-commands-installation/src/install.ts

@@ -279,7 +279,7 @@ export type InstallCommandOptions = Pick<Config,
   useBetaCli?: boolean
   recursive?: boolean
   workspace?: boolean
-} & Partial<Pick<Config, 'preferWorkspacePackages'>>
+} & Partial<Pick<Config, 'pnpmHomeDir' | 'preferWorkspacePackages'>>
 
 export async function handler (
   opts: InstallCommandOptions

packages/plugin-commands-installation/src/installDeps.ts

@@ -17,9 +17,10 @@ import {
 } from '@pnpm/core'
 import logger from '@pnpm/logger'
 import { sequenceGraph } from '@pnpm/sort-packages'
+import isSubdir from 'is-subdir'
 import getPinnedVersion from './getPinnedVersion'
 import getSaveType from './getSaveType'
-import nodeExecPath from './nodeExecPath'
+import getNodeExecPath from './nodeExecPath'
 import recursive, { createMatcher, matchDependencies } from './recursive'
 import updateToLatestSpecsFromManifest, { createLatestSpecs } from './updateToLatestSpecsFromManifest'
 import { createWorkspaceSpecs, updateToWorkspacePackagesFromManifest } from './updateWorkspaceDependencies'
@@ -83,7 +84,7 @@ export type InstallDepsOptions = Pick<Config,
   useBetaCli?: boolean
   recursive?: boolean
   workspace?: boolean
-}
+} & Partial<Pick<Config, 'pnpmHomeDir'>>
 
 export default async function handler (
   opts: InstallDepsOptions,
@@ -175,8 +176,11 @@ when running add/update with the --workspace option')
     storeDir: store.dir,
     workspacePackages,
   }
-  if (opts.global) {
-    installOpts['nodeExecPath'] = await nodeExecPath()
+  if (opts.global && opts.pnpmHomeDir != null) {
+    const nodeExecPath = await getNodeExecPath()
+    if (isSubdir(opts.pnpmHomeDir, nodeExecPath)) {
+      installOpts['nodeExecPath'] = nodeExecPath
+    }
   }
 
   let { manifest, writeProjectManifest } = await tryReadProjectManifest(opts.dir, opts)

packages/plugin-commands-installation/test/global.ts

@@ -4,7 +4,7 @@ import { add } from '@pnpm/plugin-commands-installation'
 import prepare from '@pnpm/prepare'
 import { REGISTRY_MOCK_PORT } from '@pnpm/registry-mock'
 import tempy from 'tempy'
-import nodeExecPath from '../lib/nodeExecPath'
+import getNodeExecPath from '../lib/nodeExecPath'
 
 const REGISTRY_URL = `http://localhost:${REGISTRY_MOCK_PORT}`
 const tmp = tempy.directory()
@@ -35,12 +35,14 @@ const DEFAULT_OPTIONS = {
 }
 
 test('globally installed package is linked with active version of Node.js', async () => {
+  const nodeExecPath = await getNodeExecPath()
   prepare()
   await add.handler({
     ...DEFAULT_OPTIONS,
     dir: process.cwd(),
     global: true,
     linkWorkspacePackages: false,
+    pnpmHomeDir: path.dirname(nodeExecPath),
   }, ['hello-world-js-bin'])
 
   const manifest = (await import(path.resolve('package.json')))
@@ -50,5 +52,20 @@ test('globally installed package is linked with active version of Node.js', asyn
   ).toBeTruthy()
 
   const shimContent = await fs.readFile('node_modules/.bin/hello-world-js-bin', 'utf-8')
-  expect(shimContent).toContain(await nodeExecPath())
+  expect(shimContent).toContain(nodeExecPath)
+})
+
+test('globally installed package isn not linked with active version of Node.js if the Node.js executable is not under the pnpm home directory', async () => {
+  prepare()
+  await add.handler({
+    ...DEFAULT_OPTIONS,
+    dir: process.cwd(),
+    global: true,
+    linkWorkspacePackages: false,
+    pnpmHomeDir: path.resolve('pnpm-home'),
+  }, ['hello-world-js-bin'])
+
+  const manifest = (await import(path.resolve('package.json')))
+
+  expect(manifest.dependenciesMeta).toBeFalsy()
 })