Honor pnpm workspace lockfile configuration precedence

Author: mikolalysenko

crates/socket-patch-cli/tests/in_process_redirect_pnpm.rs

@@ -1264,3 +1264,68 @@ async fn hosted_scan_with_pnpm_lockfile_dir_elsewhere_refuses() {
     let (code, doc) = run_hosted_json(&proj, &server.uri());
     assert_refused_lock_elsewhere(code, &doc, &lock, &before, &proj);
 }
+
+/// pnpm inherits workspace-root config even when
+/// invoked from a member. Absolute npmrc paths isolate inheritance; relative
+/// YAML paths are resolved from the member cwd by pnpm 10.34.5 itself.
+async fn assert_workspace_configured_lock_refused(case: &str) {
+    let server = MockServer::start().await;
+    mock_discovery(&server).await;
+    mock_reference(&server).await;
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path().join("workspace");
+    std::fs::create_dir_all(&root).unwrap();
+    let member = write_pnpm_workspace(&root);
+    let lock_dir = if case == "root-npmrc-absolute" {
+        let dir = tmp.path().join("locks");
+        std::fs::write(
+            root.join(".npmrc"),
+            format!("lockfile-dir={}\n", dir.display()),
+        )
+        .unwrap();
+        dir
+    } else if case == "root-yaml-relative" {
+        std::fs::write(
+            root.join("pnpm-workspace.yaml"),
+            "packages:\n  - packages/*\nlockfileDir: ../locks\n",
+        )
+        .unwrap();
+        root.join("packages/locks")
+    } else {
+        let dir = tmp.path().join("yaml-locks");
+        std::fs::write(
+            root.join("pnpm-workspace.yaml"),
+            format!(
+                "packages:\n  - packages/*\nlockfileDir: {}\n",
+                dir.display()
+            ),
+        )
+        .unwrap();
+        std::fs::write(member.join(".npmrc"), "lockfile-dir=../unused-locks\n").unwrap();
+        dir
+    };
+    std::fs::create_dir_all(&lock_dir).unwrap();
+    let lock = lock_dir.join("pnpm-lock.yaml");
+    std::fs::rename(root.join("pnpm-lock.yaml"), &lock).unwrap();
+    let before = std::fs::read_to_string(&lock).unwrap();
+    let (code, doc) = run_hosted_json(&member, &server.uri());
+    assert_refused_lock_elsewhere(code, &doc, &lock, &before, &member);
+}
+
+#[tokio::test]
+#[serial]
+async fn hosted_scan_inherits_workspace_npmrc_lockfile_dir() {
+    assert_workspace_configured_lock_refused("root-npmrc-absolute").await;
+}
+
+#[tokio::test]
+#[serial]
+async fn hosted_scan_resolves_inherited_lockfile_dir_from_cwd() {
+    assert_workspace_configured_lock_refused("root-yaml-relative").await;
+}
+
+#[tokio::test]
+#[serial]
+async fn hosted_scan_workspace_yaml_overrides_member_npmrc() {
+    assert_workspace_configured_lock_refused("root-yaml-precedence").await;
+}

crates/socket-patch-core/src/hosted/governing_root.rs

@@ -99,10 +99,10 @@ async fn cargo_member_refusal(root: &Path) -> Option<Refusal> {
 /// The `pnpm-lock.yaml` pnpm reads for a project directory that holds no
 /// npm-family lock of its own, when it lives elsewhere and exists:
 ///
-/// 1. a `lockfile-dir` in the project's `.npmrc`, or `lockfileDir` in its
-///    `pnpm-workspace.yaml`, naming another directory;
-/// 2. otherwise the nearest ancestor holding `pnpm-workspace.yaml` (pnpm's
-///    workspace root lookup), when the project has none of its own.
+/// The nearest `pnpm-workspace.yaml` supplies `lockfileDir`, ahead of the
+/// project's `.npmrc` and then the workspace root's `.npmrc`. A configured
+/// relative directory is resolved from the invocation cwd, as pnpm does;
+/// without an override, the workspace's lock lives at its root.
 async fn pnpm_lock_elsewhere(root: &Path) -> Option<PathBuf> {
     let has_own_lock = OWN_LOCKS
         .iter()
@@ -117,33 +117,51 @@ async fn pnpm_lock_elsewhere(root: &Path) -> Option<PathBuf> {
         .await
         .unwrap_or_else(|_| root.to_path_buf());
 
-    let workspace_yaml = read_regular_to_string(&root.join(PNPM_WORKSPACE))
-        .await
-        .ok();
-    let configured = match read_regular_to_string(&root.join(".npmrc")).await {
-        Ok(npmrc) => npmrc_top_level_value(&npmrc, "lockfile-dir"),
-        Err(_) => None,
+    let mut workspace = None;
+    for ancestor in canonical.ancestors() {
+        let path = ancestor.join(PNPM_WORKSPACE);
+        if let Ok(yaml) = read_regular_to_string(&path).await {
+            workspace = Some((ancestor.to_path_buf(), yaml));
+            break;
+        }
+        if ancestor == canonical && path.exists() {
+            // An unreadable local workspace file still bounds the project.
+            break;
+        }
+    }
+
+    // Native pnpm 10: workspace YAML beats both npmrc files; the member's
+    // npmrc beats the workspace root's. A member inherits root npmrc settings
+    // even when its own directory has no pnpm-workspace.yaml.
+    let mut configured = workspace
+        .as_ref()
+        .and_then(|(_, yaml)| workspace_lockfile_dir(yaml));
+    if configured.is_none() {
+        configured = npmrc_lockfile_dir(&canonical).await;
+    }
+    if configured.is_none() {
+        if let Some((workspace_root, _)) = &workspace {
+            if workspace_root != &canonical {
+                configured = npmrc_lockfile_dir(workspace_root).await;
+            }
+        }
     }
-    .or_else(|| workspace_yaml.as_deref().and_then(workspace_lockfile_dir));
     if let Some(dir) = configured {
+        // Even an inherited relative override is based on the invocation
+        // directory, not on the directory containing the setting.
         return lock_elsewhere(&canonical, &canonical, &dir).await;
     }
-    if workspace_yaml.is_some() || root.join(PNPM_WORKSPACE).exists() {
-        // The project is its own workspace root.
-        return None;
-    }
-    for ancestor in canonical.ancestors().skip(1) {
-        let Ok(yaml) = read_regular_to_string(&ancestor.join(PNPM_WORKSPACE)).await else {
-            continue;
-        };
-        // The workspace root may relocate the lock with its own
-        // `lockfileDir`, relative to the root.
-        let dir = workspace_lockfile_dir(&yaml).unwrap_or_else(|| ".".to_string());
-        return lock_elsewhere(&canonical, ancestor, &dir).await;
+    if let Some((workspace_root, _)) = workspace {
+        return lock_elsewhere(&canonical, &workspace_root, ".").await;
     }
     None
 }
 
+async fn npmrc_lockfile_dir(root: &Path) -> Option<String> {
+    let npmrc = read_regular_to_string(&root.join(".npmrc")).await.ok()?;
+    npmrc_top_level_value(&npmrc, "lockfile-dir")
+}
+
 /// `<base>/<dir>/pnpm-lock.yaml` when it exists and `<base>/<dir>` is not
 /// the project directory itself.
 async fn lock_elsewhere(project: &Path, base: &Path, dir: &str) -> Option<PathBuf> {
@@ -286,12 +304,16 @@ mod tests {
         assert_eq!(code(tmp.path(), "npm").await, None);
     }
 
-    /// A workspace root that relocates its lock with `lockfileDir` still
-    /// governs its members (Bugbot on #598).
+    /// An inherited relative `lockfileDir` is resolved from the member cwd,
+    /// verified with native pnpm, rather than from the workspace root.
     #[tokio::test]
     async fn pnpm_member_of_workspace_with_relocated_lock_is_refused() {
         let tmp = tempfile::tempdir().unwrap();
-        write(tmp.path(), "pnpm-lock.yaml", "lockfileVersion: '9.0'\n");
+        write(
+            tmp.path(),
+            "ws/packages/pnpm-lock.yaml",
+            "lockfileVersion: '9.0'\n",
+        );
         write(
             tmp.path(),
             "ws/pnpm-workspace.yaml",
@@ -305,6 +327,71 @@ mod tests {
         );
     }
 
+    #[tokio::test]
+    async fn pnpm_config_precedence_matches_native_workspace_install() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path().join("ws");
+        let member = root.join("packages/a");
+        write(&root, "packages/a/package.json", "{}");
+        write(&root, PNPM_LOCK, "lockfileVersion: '9.0'\n");
+        for dir in ["yaml-locks", "root-rc-locks", "member-rc-locks"] {
+            write(
+                tmp.path(),
+                &format!("{dir}/{PNPM_LOCK}"),
+                "lockfileVersion: '9.0'\n",
+            );
+        }
+        let yaml_lock = tmp.path().join("yaml-locks");
+        let root_rc_lock = tmp.path().join("root-rc-locks");
+        let member_rc_lock = tmp.path().join("member-rc-locks");
+        write(
+            &root,
+            PNPM_WORKSPACE,
+            &format!(
+                "packages:\n  - packages/*\nlockfileDir: '{}'\n",
+                yaml_lock.display()
+            ),
+        );
+        write(
+            &root,
+            ".npmrc",
+            &format!("lockfile-dir={}\n", root_rc_lock.display()),
+        );
+        write(
+            &member,
+            ".npmrc",
+            &format!("lockfile-dir={}\n", member_rc_lock.display()),
+        );
+        for expected in [&yaml_lock, &member_rc_lock, &root_rc_lock, &root] {
+            let found = pnpm_lock_elsewhere(&member).await.expect("governing lock");
+            assert_eq!(
+                std::fs::canonicalize(found).unwrap(),
+                std::fs::canonicalize(expected.join(PNPM_LOCK)).unwrap()
+            );
+            if expected == &yaml_lock {
+                write(&root, PNPM_WORKSPACE, "packages:\n  - packages/*\n");
+            } else if expected == &member_rc_lock {
+                std::fs::remove_file(member.join(".npmrc")).unwrap();
+            } else if expected == &root_rc_lock {
+                std::fs::remove_file(root.join(".npmrc")).unwrap();
+            }
+        }
+    }
+
+    #[tokio::test]
+    async fn pnpm_member_own_workspace_bounds_ancestor_lookup() {
+        let tmp = tempfile::tempdir().unwrap();
+        write(tmp.path(), PNPM_WORKSPACE, "packages:\n  - packages/*\n");
+        write(tmp.path(), PNPM_LOCK, "lockfileVersion: '9.0'\n");
+        write(tmp.path(), "packages/a/package.json", "{}");
+        write(
+            tmp.path(),
+            "packages/a/pnpm-workspace.yaml",
+            "packages: []\n",
+        );
+        assert_eq!(code(&tmp.path().join("packages/a"), "npm").await, None);
+    }
+
     /// #417: a cargo workspace member is refused with the vendored code; the
     /// root and a standalone crate are not.
     #[tokio::test]