mirror of
https://github.com/pnpm/pnpm.git
synced 2026-05-31 03:58:11 -04:00
Fixes two **independent** crashes hitting `pnpm install --frozen-lockfile` on workspaces with `injectWorkspacePackages: true` (or `dependenciesMeta.*.injected`), surfaced via `turbo prune --docker` pipelines. ## Bug 1 — peer-variant snapshot missing `resolution` (lean, defense-in-depth) A peer-variant injected workspace snapshot (`@scope/pkg@file:packages/pkg(peerA@1)(peerB@2)`) inherits its `resolution` from the base `packages:` entry (`@scope/pkg@file:packages/pkg`). When a tool prunes the lockfile and drops that base entry, readers that deref `pkgSnapshot.resolution` crash with the cryptic: ``` Cannot use 'in' operator to search for 'directory' in undefined ``` **The root cause is upstream of pnpm**: the pruner (e.g. `turbo prune`) emits an internally inconsistent lockfile. Fixed at the source in **vercel/turborepo#12825** (retain the base entry for peer-variant injected deps; minimal repro in **vercel/turborepo#12824**) — empirically verified to produce a correct pruned lockfile for a real multi-service workspace. **pnpm side (this PR): one lean normalization at the read layer** — in `convertToLockfileObject`, where base→variant inheritance already happens via `Object.assign`. When the base entry is absent, reconstruct the directory resolution from the `file:` depPath. This is *reconstruction, not guessing*: for a workspace `file:` dep the directory **is** the depPath suffix — exactly what pnpm's own writer emits. It is **defense-in-depth, not load-bearing**: with a well-formed lockfile (turbo#12825 or any correct input) the branch never fires. Because the normalization sits at the single shared read layer, it also covers the sibling `Cannot use 'in' operator … 'integrity' in undefined` on the `pnpm deploy` path (same `resolution === undefined` root, different deref site). Per review feedback: the earlier per-reader `inheritOrSynthesizeResolution` helper across 5 call sites is **removed**; normalization lives in exactly one place (`convertToLockfileObject`), and the readers are back to `main`. ## Bug 2 — lifecycle re-import wipes `.bin/<tool>` (pure pnpm; the substantive fix) `runLifecycleHooksConcurrently` re-imports an injected workspace package into its targets after `prepare`/`postinstall`. The 2022 `scanDir`-into-`filesMap` workaround (#4299) fed target-internal paths to `importPackage`; once #11088 made `importIndexedDir`'s `makeEmptyDir` fast path the default, that path wipes the target's `node_modules` before copying, so the re-import dies with `ERR_PNPM_ENOENT` on `node_modules/.bin/<tool>`. Fix: drop the `scanDir` workaround and pass `keepModulesDir: true` so `importIndexedDir` skips the destructive fast path and preserves the target's existing `node_modules` (bin symlinks + transitive deps) via its staging/move path. Stays on `storeController.importPackage`, so source files keep their **hardlinks** (no copy-loop regression). Net reduction vs `main`: the `scanDir` helper and the `node:fs` / `FilesMap` imports are removed. ## Tests - The `deps-restorer` regression fixture `peer-variant-missing-resolution` **omits the base `packages:` entry**, so it encodes the actual pruned shape and reproduces the crash on `main`: reverting the `convertToLockfileObject` change yields `resolution: undefined` for the peer-variant (→ the `lockfileToDepGraph` crash); with this PR it is reconstructed as `{ type: 'directory', directory: … }`. - A `lockfile.fs` unit test pins the heuristic boundary: a directory resolution is synthesized for a pruned `file:` peer-variant but **never** for a `file:` tarball. - A `deps-installer` regression test covers the Bug 2 re-import (injected dep with a `prepare` script + a bin-having dependency). ## Validation End-to-end on a real `injectWorkspacePackages` monorepo (`turbo prune --docker` → `pnpm install --frozen-lockfile`), on services that crash on **both** bugs with stock pnpm: - pnpm with both fixes: the crashing services build. - **vercel/turborepo#12825 + pnpm with only Bug 2** (Bug 1 fully reverted): the crashing services still **build** → confirms Bug 1 here is genuine defense-in-depth and turbo#12825 owns the root cause. - Bug 2 reproduces on stock pnpm regardless of turbo (it is purely pnpm's importer fast-path). Pairs with **vercel/turborepo#12825** (Bug 1 root cause; minimal repro **vercel/turborepo#12824**). Tracks #11663. --------- Co-authored-by: Zoltan Kochan <z@kochan.io> Co-authored-by: Eyalm321 <eyal@sunsationsusa.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: UApply Developer <developer@uapply.ai>
101 lines
3.8 KiB
TypeScript
101 lines
3.8 KiB
TypeScript
import path from 'node:path'
|
|
|
|
import { linkBins } from '@pnpm/bins.linker'
|
|
import { fetchFromDir } from '@pnpm/fetching.directory-fetcher'
|
|
import { logger } from '@pnpm/logger'
|
|
import type { StoreController } from '@pnpm/store.controller-types'
|
|
import type { ProjectManifest, ProjectRootDir } from '@pnpm/types'
|
|
import { runGroups } from 'run-groups'
|
|
|
|
import { runLifecycleHook, type RunLifecycleHookOptions } from './runLifecycleHook.js'
|
|
|
|
export type RunLifecycleHooksConcurrentlyOptions = Omit<RunLifecycleHookOptions,
|
|
| 'depPath'
|
|
| 'pkgRoot'
|
|
| 'rootModulesDir'
|
|
> & {
|
|
resolveSymlinksInInjectedDirs?: boolean
|
|
storeController: StoreController
|
|
extraNodePaths?: string[]
|
|
preferSymlinkedExecutables?: boolean
|
|
}
|
|
|
|
export interface Importer {
|
|
buildIndex: number
|
|
manifest: ProjectManifest
|
|
rootDir: ProjectRootDir
|
|
modulesDir: string
|
|
stages?: string[]
|
|
targetDirs?: string[]
|
|
}
|
|
|
|
export async function runLifecycleHooksConcurrently (
|
|
stages: string[],
|
|
importers: Importer[],
|
|
childConcurrency: number,
|
|
opts: RunLifecycleHooksConcurrentlyOptions
|
|
): Promise<void> {
|
|
const importersByBuildIndex = new Map<number, Importer[]>()
|
|
for (const importer of importers) {
|
|
if (!importersByBuildIndex.has(importer.buildIndex)) {
|
|
importersByBuildIndex.set(importer.buildIndex, [importer])
|
|
} else {
|
|
importersByBuildIndex.get(importer.buildIndex)!.push(importer)
|
|
}
|
|
}
|
|
const sortedBuildIndexes = Array.from(importersByBuildIndex.keys()).sort((a, b) => a - b)
|
|
const groups = sortedBuildIndexes.map((buildIndex) => {
|
|
const importers = importersByBuildIndex.get(buildIndex)!
|
|
return importers.map(({ manifest, modulesDir, rootDir, stages: importerStages, targetDirs }) =>
|
|
async () => {
|
|
// We are linking the bin files, in case they were created by lifecycle scripts of other workspace packages.
|
|
await linkBins(modulesDir, path.join(modulesDir, '.bin'), {
|
|
extraNodePaths: opts.extraNodePaths,
|
|
allowExoticManifests: true,
|
|
preferSymlinkedExecutables: opts.preferSymlinkedExecutables,
|
|
projectManifest: manifest,
|
|
warn: (message: string) => {
|
|
logger.warn({ message, prefix: rootDir })
|
|
},
|
|
})
|
|
const runLifecycleHookOpts: RunLifecycleHookOptions = {
|
|
...opts,
|
|
depPath: rootDir,
|
|
pkgRoot: rootDir,
|
|
rootModulesDir: modulesDir,
|
|
}
|
|
let isBuilt = false
|
|
for (const stage of (importerStages ?? stages)) {
|
|
if (await runLifecycleHook(stage, manifest, runLifecycleHookOpts)) { // eslint-disable-line no-await-in-loop
|
|
isBuilt = true
|
|
}
|
|
}
|
|
if (targetDirs == null || targetDirs.length === 0 || !isBuilt) return
|
|
// Re-import only the freshly-built source — fetchFromDir already
|
|
// excludes the source's node_modules/. `keepModulesDir: true` makes
|
|
// importIndexedDir skip the destructive makeEmptyDir fast path
|
|
// (#11088) and preserve the target's existing node_modules (bin
|
|
// symlinks + transitive deps from the initial install) via its
|
|
// staging/move path. Replaces the old scanDir-into-filesMap
|
|
// workaround (#4299) that the fast path then wiped, causing ENOENT
|
|
// on .bin/<tool>. Stays on storeController.importPackage so source
|
|
// files keep their hardlinks (no copy-loop).
|
|
const filesResponse = await fetchFromDir(rootDir, { resolveSymlinks: opts.resolveSymlinksInInjectedDirs })
|
|
await Promise.all(
|
|
targetDirs.map(async (targetDir) =>
|
|
opts.storeController.importPackage(targetDir, {
|
|
filesResponse: {
|
|
resolvedFrom: 'local-dir',
|
|
...filesResponse,
|
|
},
|
|
force: false,
|
|
keepModulesDir: true,
|
|
})
|
|
)
|
|
)
|
|
}
|
|
)
|
|
})
|
|
await runGroups(childConcurrency, groups)
|
|
}
|