Files
pnpm/exec/lifecycle/src/runLifecycleHooksConcurrently.ts
Eyal Mizrachi 9cb48bb27b fix: injectWorkspacePackages crashes — lean resolution defense-in-depth + lifecycle re-import (#11662)
Fixes two **independent** crashes hitting `pnpm install --frozen-lockfile` on workspaces with `injectWorkspacePackages: true` (or `dependenciesMeta.*.injected`), surfaced via `turbo prune --docker` pipelines.

## Bug 1 — peer-variant snapshot missing `resolution` (lean, defense-in-depth)

A peer-variant injected workspace snapshot (`@scope/pkg@file:packages/pkg(peerA@1)(peerB@2)`) inherits its `resolution` from the base `packages:` entry (`@scope/pkg@file:packages/pkg`). When a tool prunes the lockfile and drops that base entry, readers that deref `pkgSnapshot.resolution` crash with the cryptic:

```
Cannot use 'in' operator to search for 'directory' in undefined
```

**The root cause is upstream of pnpm**: the pruner (e.g. `turbo prune`) emits an internally inconsistent lockfile. Fixed at the source in **vercel/turborepo#12825** (retain the base entry for peer-variant injected deps; minimal repro in **vercel/turborepo#12824**) — empirically verified to produce a correct pruned lockfile for a real multi-service workspace.

**pnpm side (this PR): one lean normalization at the read layer** — in `convertToLockfileObject`, where base→variant inheritance already happens via `Object.assign`. When the base entry is absent, reconstruct the directory resolution from the `file:` depPath. This is *reconstruction, not guessing*: for a workspace `file:` dep the directory **is** the depPath suffix — exactly what pnpm's own writer emits. It is **defense-in-depth, not load-bearing**: with a well-formed lockfile (turbo#12825 or any correct input) the branch never fires. Because the normalization sits at the single shared read layer, it also covers the sibling `Cannot use 'in' operator … 'integrity' in undefined` on the `pnpm deploy` path (same `resolution === undefined` root, different deref site).

Per review feedback: the earlier per-reader `inheritOrSynthesizeResolution` helper across 5 call sites is **removed**; normalization lives in exactly one place (`convertToLockfileObject`), and the readers are back to `main`.

## Bug 2 — lifecycle re-import wipes `.bin/<tool>` (pure pnpm; the substantive fix)

`runLifecycleHooksConcurrently` re-imports an injected workspace package into its targets after `prepare`/`postinstall`. The 2022 `scanDir`-into-`filesMap` workaround (#4299) fed target-internal paths to `importPackage`; once #11088 made `importIndexedDir`'s `makeEmptyDir` fast path the default, that path wipes the target's `node_modules` before copying, so the re-import dies with `ERR_PNPM_ENOENT` on `node_modules/.bin/<tool>`.

Fix: drop the `scanDir` workaround and pass `keepModulesDir: true` so `importIndexedDir` skips the destructive fast path and preserves the target's existing `node_modules` (bin symlinks + transitive deps) via its staging/move path. Stays on `storeController.importPackage`, so source files keep their **hardlinks** (no copy-loop regression). Net reduction vs `main`: the `scanDir` helper and the `node:fs` / `FilesMap` imports are removed.

## Tests

- The `deps-restorer` regression fixture `peer-variant-missing-resolution` **omits the base `packages:` entry**, so it encodes the actual pruned shape and reproduces the crash on `main`: reverting the `convertToLockfileObject` change yields `resolution: undefined` for the peer-variant (→ the `lockfileToDepGraph` crash); with this PR it is reconstructed as `{ type: 'directory', directory: … }`.
- A `lockfile.fs` unit test pins the heuristic boundary: a directory resolution is synthesized for a pruned `file:` peer-variant but **never** for a `file:` tarball.
- A `deps-installer` regression test covers the Bug 2 re-import (injected dep with a `prepare` script + a bin-having dependency).

## Validation

End-to-end on a real `injectWorkspacePackages` monorepo (`turbo prune --docker` → `pnpm install --frozen-lockfile`), on services that crash on **both** bugs with stock pnpm:

- pnpm with both fixes: the crashing services build.
- **vercel/turborepo#12825 + pnpm with only Bug 2** (Bug 1 fully reverted): the crashing services still **build** → confirms Bug 1 here is genuine defense-in-depth and turbo#12825 owns the root cause.
- Bug 2 reproduces on stock pnpm regardless of turbo (it is purely pnpm's importer fast-path).

Pairs with **vercel/turborepo#12825** (Bug 1 root cause; minimal repro **vercel/turborepo#12824**). Tracks #11663.

---------

Co-authored-by: Zoltan Kochan <z@kochan.io>
Co-authored-by: Eyalm321 <eyal@sunsationsusa.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: UApply Developer <developer@uapply.ai>
2026-05-20 00:31:07 +02:00

101 lines
3.8 KiB
TypeScript

import path from 'node:path'
import { linkBins } from '@pnpm/bins.linker'
import { fetchFromDir } from '@pnpm/fetching.directory-fetcher'
import { logger } from '@pnpm/logger'
import type { StoreController } from '@pnpm/store.controller-types'
import type { ProjectManifest, ProjectRootDir } from '@pnpm/types'
import { runGroups } from 'run-groups'
import { runLifecycleHook, type RunLifecycleHookOptions } from './runLifecycleHook.js'
export type RunLifecycleHooksConcurrentlyOptions = Omit<RunLifecycleHookOptions,
| 'depPath'
| 'pkgRoot'
| 'rootModulesDir'
> & {
resolveSymlinksInInjectedDirs?: boolean
storeController: StoreController
extraNodePaths?: string[]
preferSymlinkedExecutables?: boolean
}
export interface Importer {
buildIndex: number
manifest: ProjectManifest
rootDir: ProjectRootDir
modulesDir: string
stages?: string[]
targetDirs?: string[]
}
export async function runLifecycleHooksConcurrently (
stages: string[],
importers: Importer[],
childConcurrency: number,
opts: RunLifecycleHooksConcurrentlyOptions
): Promise<void> {
const importersByBuildIndex = new Map<number, Importer[]>()
for (const importer of importers) {
if (!importersByBuildIndex.has(importer.buildIndex)) {
importersByBuildIndex.set(importer.buildIndex, [importer])
} else {
importersByBuildIndex.get(importer.buildIndex)!.push(importer)
}
}
const sortedBuildIndexes = Array.from(importersByBuildIndex.keys()).sort((a, b) => a - b)
const groups = sortedBuildIndexes.map((buildIndex) => {
const importers = importersByBuildIndex.get(buildIndex)!
return importers.map(({ manifest, modulesDir, rootDir, stages: importerStages, targetDirs }) =>
async () => {
// We are linking the bin files, in case they were created by lifecycle scripts of other workspace packages.
await linkBins(modulesDir, path.join(modulesDir, '.bin'), {
extraNodePaths: opts.extraNodePaths,
allowExoticManifests: true,
preferSymlinkedExecutables: opts.preferSymlinkedExecutables,
projectManifest: manifest,
warn: (message: string) => {
logger.warn({ message, prefix: rootDir })
},
})
const runLifecycleHookOpts: RunLifecycleHookOptions = {
...opts,
depPath: rootDir,
pkgRoot: rootDir,
rootModulesDir: modulesDir,
}
let isBuilt = false
for (const stage of (importerStages ?? stages)) {
if (await runLifecycleHook(stage, manifest, runLifecycleHookOpts)) { // eslint-disable-line no-await-in-loop
isBuilt = true
}
}
if (targetDirs == null || targetDirs.length === 0 || !isBuilt) return
// Re-import only the freshly-built source — fetchFromDir already
// excludes the source's node_modules/. `keepModulesDir: true` makes
// importIndexedDir skip the destructive makeEmptyDir fast path
// (#11088) and preserve the target's existing node_modules (bin
// symlinks + transitive deps from the initial install) via its
// staging/move path. Replaces the old scanDir-into-filesMap
// workaround (#4299) that the fast path then wiped, causing ENOENT
// on .bin/<tool>. Stays on storeController.importPackage so source
// files keep their hardlinks (no copy-loop).
const filesResponse = await fetchFromDir(rootDir, { resolveSymlinks: opts.resolveSymlinksInInjectedDirs })
await Promise.all(
targetDirs.map(async (targetDir) =>
opts.storeController.importPackage(targetDir, {
filesResponse: {
resolvedFrom: 'local-dir',
...filesResponse,
},
force: false,
keepModulesDir: true,
})
)
)
}
)
})
await runGroups(childConcurrency, groups)
}