@npmcli/arborist 8.0.2 → 8.0.4

package/lib/arborist/isolated-reifier.js

@@ -3,6 +3,7 @@ const pacote = require('pacote')
 const { join } = require('node:path')
 const { depth } = require('treeverse')
 const crypto = require('node:crypto')
+const { IsolatedNode, IsolatedLink } = require('../isolated-classes.js')
 
 // generate short hash key based on the dependency tree starting at this node
 const getKey = (startNode) => {
@@ -33,43 +34,25 @@ const getKey = (startNode) => {
 
 module.exports = cls => class IsolatedReifier extends cls {
   #externalProxies = new Map()
+  #omit = new Set()
+  #rootDeclaredDeps = new Set()
   #processedEdges = new Set()
   #workspaceProxies = new Map()
 
-  #generateChild (node, location, pkg, inStore, root) {
-    const newChild = {
-      binPaths: [],
-      children: new Map(),
-      edgesIn: new Set(),
-      edgesOut: new Map(),
-      fsChildren: new Set(),
-      /* istanbul ignore next -- emulate Node */
-      getBundler () {
-        return null
-      },
-      global: false,
-      globalTop: false,
-      hasShrinkwrap: false,
-      inDepBundle: false,
-      integrity: null,
-      isInStore: inStore,
-      isLink: false,
-      isProjectRoot: false,
-      isRoot: false,
-      isTop: false,
+  #generateChild (node, location, pkg, isInStore, root) {
+    const newChild = new IsolatedNode({
+      isInStore,
       location,
       name: node.packageName || node.name,
       optional: node.optional,
       package: pkg,
       parent: root,
-      path: join(this.idealGraph.root.localPath, location),
-      realpath: join(this.idealGraph.root.localPath, location),
+      path: join(this.idealGraph.localPath, location),
       resolved: node.resolved,
       root,
-      top: { path: this.idealGraph.root.localPath },
-      version: pkg.version,
-    }
-    newChild.target = newChild
+    })
+    // XXX top is from place-dep not lib/node.js
+    newChild.top = { path: this.idealGraph.localPath }
     root.children.set(newChild.location, newChild)
     root.inventory.set(newChild.location, newChild)
   }
@@ -90,16 +73,31 @@ module.exports = cls => class IsolatedReifier extends cls {
    **/
   async makeIdealGraph () {
     const idealTree = this.idealTree
-
+    this.#omit = new Set(this.options.omit)
+    const omit = this.#omit
+
+    // npm auto-creates 'workspace' edges from root to all workspaces.
+    // For isolated/linked mode, only include workspaces that root explicitly declares as dependencies.
+    // When omitting dep types, exclude those from the declared set so their workspaces aren't hoisted.
+    const rootPkg = idealTree.package
+    this.#rootDeclaredDeps = new Set(Object.keys(Object.assign({},
+      rootPkg.dependencies,
+      (!omit.has('dev') && rootPkg.devDependencies),
+      (!omit.has('optional') && rootPkg.optionalDependencies),
+      (!omit.has('peer') && rootPkg.peerDependencies)
+    )))
+
+    // XXX this sometimes acts like a node too
     this.idealGraph = {
       external: [],
       isProjectRoot: true,
       localLocation: idealTree.location,
       localPath: idealTree.path,
+      path: idealTree.path,
     }
     this.counter = 0
 
-    this.idealGraph.workspaces = await Promise.all(Array.from(idealTree.fsChildren.values(), w => this.workspaceProxy(w)))
+    this.idealGraph.workspaces = await Promise.all(Array.from(idealTree.fsChildren.values(), w => this.#workspaceProxy(w)))
     const processed = new Set()
     const queue = [idealTree, ...idealTree.fsChildren]
     while (queue.length !== 0) {
@@ -109,43 +107,43 @@ module.exports = cls => class IsolatedReifier extends cls {
       }
       processed.add(next.location)
       next.edgesOut.forEach(edge => {
-        if (edge.to && !(next.package.bundleDependencies || next.package.bundledDependencies || []).includes(edge.to.name)) {
+        if (edge.to && !(next.package.bundleDependencies || next.package.bundledDependencies || []).includes(edge.to.name) && !edge.to.shouldOmit?.(omit)) {
           queue.push(edge.to)
         }
       })
       // local `file:` deps are in fsChildren but are not workspaces.
       // they are already handled as workspace-like proxies above and should not go through the external/store extraction path.
       if (!next.isProjectRoot && !next.isWorkspace && !next.inert && !idealTree.fsChildren.has(next) && !idealTree.fsChildren.has(next.target)) {
-        this.idealGraph.external.push(await this.externalProxy(next))
+        this.idealGraph.external.push(await this.#externalProxy(next))
       }
     }
 
-    await this.assignCommonProperties(idealTree, this.idealGraph)
+    await this.#assignCommonProperties(idealTree, this.idealGraph)
   }
 
-  async workspaceProxy (node) {
+  async #workspaceProxy (node) {
     if (this.#workspaceProxies.has(node)) {
       return this.#workspaceProxies.get(node)
     }
     const result = {}
-    // XXX this goes recursive if we don't set here because assignCommonProperties also calls this.workspaceProxy
+    // XXX this goes recursive if we don't set here because assignCommonProperties also calls this.#workspaceProxy
     this.#workspaceProxies.set(node, result)
     result.localLocation = node.location
     result.localPath = node.path
     result.isWorkspace = true
     result.resolved = node.resolved
-    await this.assignCommonProperties(node, result)
+    await this.#assignCommonProperties(node, result)
     return result
   }
 
-  async externalProxy (node) {
+  async #externalProxy (node) {
     if (this.#externalProxies.has(node)) {
       return this.#externalProxies.get(node)
     }
     const result = {}
-    // XXX this goes recursive if we don't set here because assignCommonProperties also calls this.externalProxy
+    // XXX this goes recursive if we don't set here because assignCommonProperties also calls this.#externalProxy
     this.#externalProxies.set(node, result)
-    await this.assignCommonProperties(node, result, !node.hasShrinkwrap)
+    await this.#assignCommonProperties(node, result, !node.hasShrinkwrap)
     if (node.hasShrinkwrap) {
       const dir = join(
         node.root.path,
@@ -187,8 +185,9 @@ module.exports = cls => class IsolatedReifier extends cls {
     return result
   }
 
-  async assignCommonProperties (node, result, populateDeps = true) {
+  async #assignCommonProperties (node, result, populateDeps = true) {
     result.root = this.idealGraph
+    // XXX does anything need this?
     result.id = this.counter++
     /* istanbul ignore next - packageName is always set for real packages */
     result.name = result.isWorkspace ? (node.packageName || node.name) : node.name
@@ -196,17 +195,39 @@ module.exports = cls => class IsolatedReifier extends cls {
     result.packageName = node.packageName || node.name
     result.package = { ...node.package }
     result.package.bundleDependencies = undefined
-    result.hasInstallScript = node.hasInstallScript
 
     if (!populateDeps) {
       return
     }
 
-    const edges = [...node.edgesOut.values()].filter(edge =>
+    let edges = [...node.edgesOut.values()].filter(edge =>
       edge.to?.target &&
       !(node.package.bundledDependencies || node.package.bundleDependencies)?.includes(edge.to.name)
     )
-    const nonOptionalDeps = edges.filter(edge => !edge.optional).map(edge => edge.to.target)
+
+    // Only omit edge types for root and workspace nodes (matching shouldOmit scope)
+    if ((node.isProjectRoot || node.isWorkspace) && this.#omit.size) {
+      edges = edges.filter(edge => {
+        if (edge.dev && this.#omit.has('dev')) {
+          return false
+        }
+        if (edge.optional && this.#omit.has('optional')) {
+          return false
+        }
+        if (edge.peer && this.#omit.has('peer')) {
+          return false
+        }
+        return true
+      })
+    }
+
+    let nonOptionalDeps = edges.filter(edge => !edge.optional).map(edge => edge.to.target)
+
+    // npm auto-creates 'workspace' edges from root to all workspaces.
+    // For isolated/linked mode, only include workspaces that root explicitly declares as dependencies.
+    if (node.isProjectRoot) {
+      nonOptionalDeps = nonOptionalDeps.filter(n => !n.isWorkspace || this.#rootDeclaredDeps.has(n.packageName))
+    }
 
     // When legacyPeerDeps is enabled, peer dep edges are not created on the node.
     // Resolve them from the tree so they get symlinked in the store.
@@ -226,9 +247,9 @@ module.exports = cls => class IsolatedReifier extends cls {
     // local `file:` deps (non-workspace fsChildren) should be treated as local dependencies, not external, so they get symlinked directly instead of being extracted into the store.
     const isLocal = (n) => n.isWorkspace || node.fsChildren?.has(n)
     const optionalDeps = edges.filter(edge => edge.optional).map(edge => edge.to.target)
-    result.localDependencies = await Promise.all(nonOptionalDeps.filter(isLocal).map(n => this.workspaceProxy(n)))
-    result.externalDependencies = await Promise.all(nonOptionalDeps.filter(n => !isLocal(n) && !n.inert).map(n => this.externalProxy(n)))
-    result.externalOptionalDependencies = await Promise.all(optionalDeps.filter(n => !n.inert).map(n => this.externalProxy(n)))
+    result.localDependencies = await Promise.all(nonOptionalDeps.filter(isLocal).map(n => this.#workspaceProxy(n)))
+    result.externalDependencies = await Promise.all(nonOptionalDeps.filter(n => !isLocal(n) && !n.inert).map(n => this.#externalProxy(n)))
+    result.externalOptionalDependencies = await Promise.all(optionalDeps.filter(n => !n.inert).map(n => this.#externalProxy(n)))
     result.dependencies = [
       ...result.externalDependencies,
       ...result.localDependencies,
@@ -288,91 +309,47 @@ module.exports = cls => class IsolatedReifier extends cls {
 
   async createIsolatedTree () {
     await this.makeIdealGraph()
-
     const bundledTree = await this.#createBundledTree()
 
-    const root = {
-      binPaths: [],
-      children: new Map(),
-      edgesIn: new Set(),
-      edgesOut: new Map(),
-      fsChildren: new Set(),
-      global: false,
-      hasShrinkwrap: false,
-      integrity: null,
-      inventory: new Map(),
-      isLink: false,
-      isProjectRoot: true,
-      isRoot: true,
-      isTop: true,
-      linksIn: new Set(),
-      meta: { loadedFromDisk: false },
-      package: this.idealGraph.root.package,
-      parent: null,
-      path: this.idealGraph.root.localPath,
-      realpath: this.idealGraph.root.localPath,
-      // TODO: we should probably not reference this.idealTree
-      resolved: this.idealTree.resolved,
-      tops: new Set(),
-      workspaces: new Map(),
-    }
-    root.inventory.set('', root)
+    const root = new IsolatedNode(this.idealGraph)
     root.root = root
-    root.target = root
-    // TODO inventory.query is a stub; audit-report needs 'packageName' support
-    root.inventory.query = () => {
-      return []
-    }
+    root.top = root
+    root.inventory.set('', root)
     const processed = new Set()
     for (const c of this.idealGraph.workspaces) {
       const wsName = c.packageName
-      const workspace = {
-        binPaths: [],
-        children: new Map(),
-        edgesIn: new Set(),
-        edgesOut: new Map(),
-        fsChildren: new Set(),
-        hasInstallScript: c.hasInstallScript,
-        isLink: false,
-        isRoot: false,
-        linksIn: new Set(),
+      // XXX parent? root?
+      const workspace = new IsolatedNode({
         location: c.localLocation,
         name: wsName,
         package: c.package,
         path: c.localPath,
-        realpath: c.localPath,
         resolved: c.resolved,
-      }
-      workspace.target = workspace
+      })
+      workspace.top = workspace
+      workspace.isWorkspace = true
       root.fsChildren.add(workspace)
       root.inventory.set(workspace.location, workspace)
+      root.workspaces.set(wsName, workspace.path)
 
-      // Create workspace Link entry in children for _diffTrees lookup
-      const wsLink = {
-        binPaths: [],
-        children: new Map(),
-        edgesIn: new Set(),
-        edgesOut: new Map(),
-        fsChildren: new Set(),
-        global: false,
-        globalTop: false,
-        isLink: true,
-        isProjectRoot: false,
-        isRoot: false,
-        isTop: false,
-        linksIn: new Set(),
-        location: join('node_modules', wsName),
+      // Create workspace Link. For root declared deps, link at root node_modules/. For undeclared deps, link at the workspace's own node_modules/ (self-link).
+      const isDeclared = this.#rootDeclaredDeps.has(wsName)
+      const wsLink = new IsolatedLink({
+        location: isDeclared ? join('node_modules', wsName) : join(c.localLocation, 'node_modules', wsName),
         name: wsName,
         package: workspace.package,
         parent: root,
-        path: join(root.path, 'node_modules', wsName),
+        path: isDeclared ? join(root.path, 'node_modules', wsName) : join(root.path, c.localLocation, 'node_modules', wsName),
         realpath: workspace.path,
         root,
         target: workspace,
+      })
+      wsLink.top = root
+      if (!isDeclared) {
+        workspace.children.set(wsName, wsLink)
       }
-      root.children.set(wsLink.name, wsLink)
+      root.children.set(wsName, wsLink)
       root.inventory.set(wsLink.location, wsLink)
-      root.workspaces.set(wsName, workspace.path)
       workspace.linksIn.add(wsLink)
     }
 
@@ -466,35 +443,29 @@ module.exports = cls => class IsolatedReifier extends cls {
       }
     }
 
-    const link = {
-      binPaths: [],
-      children: new Map(),
-      edgesIn: new Set(),
-      edgesOut: new Map(),
-      fsChildren: new Set(),
-      global: false,
-      globalTop: false,
-      isLink: true,
-      isProjectRoot: false,
-      isRoot: false,
+    const pkg = {
+      _id: dep.package._id,
+      bin: target.package.bin,
+      bundleDependencies: undefined,
+      deprecated: undefined,
+      scripts: dep.package.scripts,
+      version: dep.package.version,
+    }
+    const link = new IsolatedLink({
       isStoreLink: true,
-      isTop: false,
       location: join(nmFolder, dep.name),
       name: toKey,
       optional,
-      // TODO _id: 'abc' ?
-      package: { _id: 'abc', bundleDependencies: undefined, deprecated: undefined, bin: target.package.bin, scripts: dep.package.scripts },
       parent: root,
+      package: pkg,
       path: join(dep.root.localPath, nmFolder, dep.name),
       realpath: target.path,
-      resolved: external
-        ? `file:.store/${toKey}/node_modules/${dep.packageName}`
-        : dep.resolved,
+      resolved: external ? `file:.store/${toKey}/node_modules/${dep.packageName}` : dep.resolved,
       root,
       target,
-      version: dep.version,
-      top: { path: dep.root.localPath },
-    }
+    })
+    // XXX top is from place-dep not lib/link.js
+    link.top = { path: dep.root.localPath }
     const newEdge1 = { optional, from, to: link }
     from.edgesOut.set(dep.name, newEdge1)
     link.edgesIn.add(newEdge1)

package/lib/arborist/reify.js

@@ -36,6 +36,7 @@ const { callLimit: promiseCallLimit } = require('promise-call-limit')
 const optionalSet = require('../optional-set.js')
 const calcDepFlags = require('../calc-dep-flags.js')
 const { saveTypeMap, hasSubKey } = require('../add-rm-pkg-deps.js')
+const { IsolatedNode, IsolatedLink } = require('../isolated-classes.js')
 
 const Shrinkwrap = require('../shrinkwrap.js')
 const { defaultLockfileVersion } = Shrinkwrap
@@ -138,9 +139,11 @@ module.exports = cls => class Reifier extends cls {
       // of Node/Link trees
       log.warn('reify', 'The "linked" install strategy is EXPERIMENTAL and may contain bugs.')
       this.idealTree = await this.createIsolatedTree()
-      this.#linkedActualForDiff = this.#buildLinkedActualForDiff(
-        this.idealTree, this.actualTree
-      )
+      if (this.actualTree) {
+        this.#linkedActualForDiff = this.#buildLinkedActualForDiff(
+          this.idealTree, this.actualTree
+        )
+      }
     }
     await this[_diffTrees]()
     await this[_reifyPackages]()
@@ -841,49 +844,27 @@ module.exports = cls => class Reifier extends cls {
   #buildLinkedActualForDiff (idealTree, actualTree) {
     const combined = new Map()
 
-    for (const child of actualTree.children.values()) {
-      combined.set(child.path, child)
-    }
-
+    // Create synthetic actual entries for ALL ideal children that exist on disk.
+    // The isolated ideal tree is flat (all entries as root children), but loadActual() produces a nested tree where workspace deps are under fsChildren and store entries are deep link targets.
+    // Synthetic entries ensure the diff compares matching resolved/integrity values (e.g. workspace links have resolved=undefined in the ideal tree but resolved="file:../packages/..." in the actual tree).
     for (const child of idealTree.children.values()) {
-      if (!combined.has(child.path) && (child.isInStore || child.isStoreLink) &&
-          existsSync(child.path)) {
-        const entry = {
-          global: false,
-          globalTop: false,
-          isProjectRoot: false,
-          isTop: false,
-          location: child.location,
-          name: child.name,
-          optional: child.optional,
-          top: child.top,
-          children: [],
-          edgesIn: new Set(),
-          edgesOut: new Map(),
-          binPaths: [],
-          fsChildren: [],
-          /* istanbul ignore next -- emulate Node */
-          getBundler () {
-            return null
-          },
-          hasShrinkwrap: false,
-          inDepBundle: false,
-          integrity: null,
-          isLink: Boolean(child.isLink),
-          isRoot: false,
-          isInStore: Boolean(child.isInStore),
-          path: child.path,
-          realpath: child.realpath,
-          resolved: child.resolved,
-          version: child.version,
-          package: child.package,
-        }
-        entry.target = entry
-        if (child.isLink && combined.has(child.realpath)) {
-          entry.target = combined.get(child.realpath)
-        }
-        combined.set(child.path, entry)
+      if (combined.has(child.path) || !existsSync(child.path)) {
+        continue
+      }
+      // Skip store links whose ideal realpath doesn't exist on disk yet — the store hash changed and the symlink needs recreating via ADD.
+      if (child.isLink && child.resolved?.startsWith('file:.store/') && !existsSync(child.realpath)) {
+        continue
+      }
+      let entry
+      if (child.isLink) {
+        entry = new IsolatedLink(child)
+      } else {
+        entry = new IsolatedNode(child)
+      }
+      if (child.isLink && combined.has(child.realpath)) {
+        entry.target = combined.get(child.realpath)
       }
+      combined.set(child.path, entry)
     }
 
     const origGet = actualTree.children.get.bind(actualTree.children)
@@ -891,32 +872,22 @@ module.exports = cls => class Reifier extends cls {
     /* istanbul ignore next -- only reached during scoped workspace installs */
     combined.get = (key) => combinedGet(key) || origGet(key)
 
-    const wrapper = {
-      isRoot: true,
-      isLink: actualTree.isLink,
-      target: actualTree.target,
-      fsChildren: actualTree.fsChildren,
-      path: actualTree.path,
-      realpath: actualTree.realpath,
-      edgesOut: actualTree.edgesOut,
-      inventory: actualTree.inventory,
-      package: actualTree.package,
-      resolved: actualTree.resolved,
-      version: actualTree.version,
-      integrity: actualTree.integrity,
-      binPaths: actualTree.binPaths,
-      hasShrinkwrap: false,
-      inDepBundle: false,
-      parent: null,
-      children: combined,
-    }
-
-    for (const child of combined.values()) {
-      if (!child.parent) {
-        child.parent = wrapper
-        child.root = wrapper
-      }
+    let wrapper
+    /* istanbul ignore next - untested! */
+    if (actualTree.isLink) {
+      wrapper = new IsolatedLink(actualTree)
+    } else {
+      wrapper = new IsolatedNode(actualTree)
     }
+    wrapper.root = wrapper
+    wrapper.binPaths = actualTree.binPaths
+    wrapper.children = combined
+    wrapper.edgesOut = actualTree.edgesOut
+    // Use empty fsChildren so that allChildren() only picks up entries from the combined map.
+    // The actual fsChildren have real children with different resolved values (e.g. file:../../../node_modules/.store/... vs file:.store/...) that would overwrite our synthetic entries in allChildren().
+    wrapper.fsChildren = new Set()
+    wrapper.integrity = actualTree.integrity
+    wrapper.inventory = actualTree.inventory
 
     return wrapper
   }

package/lib/inventory.js

@@ -1,5 +1,4 @@
-// a class to manage an inventory and set of indexes of a set of objects based
-// on specific fields.
+// a class to manage an inventory and set of indexes of a set of objects based on specific fields.
 const { hasOwnProperty } = Object.prototype
 const debug = require('./debug.js')
 

package/lib/isolated-classes.js

@@ -0,0 +1,138 @@
+// Alternate versions of different classes that we use for isolated mode
+const CaseInsensitiveMap = require('./case-insensitive-map.js')
+const { resolve } = require('node:path')
+
+// fake lib/inventory.js
+class IsolatedInventory extends Map {
+  query () {
+    return []
+  }
+}
+
+// fake lib/node.js
+class IsolatedNode {
+  binPaths = []
+  children = new CaseInsensitiveMap()
+  edgesIn = new Set()
+  edgesOut = new CaseInsensitiveMap()
+  fsChildren = new Set()
+  hasShrinkwrap = false
+  integrity = null
+  inventory = new IsolatedInventory()
+  isInStore = false
+  linksIn = new Set()
+  meta = { loadedFromDisk: false }
+  optional = false
+  parent = null
+  root = null
+  tops = new Set()
+  workspaces = new Map()
+
+  constructor (options) {
+    this.location = options.location
+    this.name = options.name
+    this.package = options.package
+    this.path = options.path
+    this.realpath = !this.isLink ? this.path : resolve(options.realpath)
+
+    if (options.parent) {
+      this.parent = options.parent
+    }
+    if (options.resolved) {
+      this.resolved = options.resolved
+    }
+    if (options.root) {
+      this.root = options.root
+    }
+    if (options.isInStore) {
+      this.isInStore = true
+    }
+    if (options.optional) {
+      this.optional = true
+    }
+  }
+
+  get isRoot () {
+    return this === this.root
+  }
+
+  // The idealGraph is where this is set to true
+  get isProjectRoot () {
+    return false
+  }
+
+  get inDepBundle () {
+    return false
+  }
+
+  get isLink () {
+    return false
+  }
+
+  get isTop () {
+    return !this.parent
+  }
+
+  /* istanbul ignore next -- emulate lib/node.js */
+  get global () {
+    return false
+  }
+
+  get globalTop () {
+    return false
+  }
+
+  /* istanbul ignore next -- emulate lib/node.js */
+  set target (t) {
+    // nop
+    // In the real lib/node.js this throws in debug mode
+  }
+
+  get target () {
+    return this
+  }
+
+  /* istanbul ignore next -- emulate lib/node.js */
+  getBundler () {
+    return null
+  }
+
+  /* istanbul ignore next -- emulate lib/node.js */
+  get hasInstallScript () {
+    const { hasInstallScript, scripts } = this.package
+    const { install, preinstall, postinstall } = scripts || {}
+    return !!(hasInstallScript || install || preinstall || postinstall)
+  }
+
+  get version () {
+    return this.package.version
+  }
+}
+
+// fake lib/link.js
+class IsolatedLink extends IsolatedNode {
+  #target
+  isStoreLink = false
+
+  constructor (options) {
+    super(options)
+    this.#target = options.target
+    if (options.isStoreLink) {
+      this.isStoreLink = true
+    }
+  }
+
+  get isLink () {
+    return true
+  }
+
+  set target (t) {
+    this.#target = t
+  }
+
+  get target () {
+    return this.#target
+  }
+}
+
+module.exports = { IsolatedNode, IsolatedLink }

package/lib/node.js

@@ -74,33 +74,32 @@ class Node {
   constructor (options) {
     // NB: path can be null if it's a link target
     const {
-      root,
-      path,
-      realpath,
-      parent,
-      error,
-      meta,
-      fsParent,
-      resolved,
-      integrity,
-      // allow setting name explicitly when we haven't set a path yet
-      name,
       children,
+      dev = true,
+      devOptional = true,
+      dummy = false,
+      error,
+      extraneous = true,
       fsChildren,
+      fsParent,
+      global = false,
+      hasShrinkwrap,
       installLinks = false,
+      integrity,
+      isInStore = false,
       legacyPeerDeps = false,
       linksIn,
-      isInStore = false,
-      hasShrinkwrap,
-      overrides,
       loadOverrides = false,
-      extraneous = true,
-      dev = true,
+      meta,
+      name, // allow setting name explicitly when we haven't set a path yet
       optional = true,
-      devOptional = true,
+      overrides,
+      parent,
+      path,
       peer = true,
-      global = false,
-      dummy = false,
+      realpath,
+      resolved,
+      root,
       sourceReference = null,
     } = options
     // this object gives querySelectorAll somewhere to stash context about a node
@@ -464,6 +463,27 @@ class Node {
     return false
   }
 
+  shouldOmit (omitSet) {
+    if (!omitSet.size) {
+      return false
+    }
+
+    const { top } = this
+
+    // if the top is not the root or workspace then we do not want to omit it
+    if (!top.isProjectRoot && !top.isWorkspace) {
+      return false
+    }
+
+    // omit node if the dep type matches any omit flags that were set
+    return (
+      this.peer && omitSet.has('peer') ||
+      this.dev && omitSet.has('dev') ||
+      this.optional && omitSet.has('optional') ||
+      this.devOptional && omitSet.has('optional') && omitSet.has('dev')
+    )
+  }
+
   getBundler (path = []) {
     // made a cycle, definitely not bundled!
     if (path.includes(this)) {

package/lib/override-set.js

@@ -1,5 +1,6 @@
 const npa = require('npm-package-arg')
 const semver = require('semver')
+const { log } = require('proc-log')
 
 class OverrideSet {
   constructor ({ overrides, key, parent }) {
@@ -44,6 +45,43 @@ class OverrideSet {
     }
   }
 
+  childrenAreEqual (other) {
+    if (this.children.size !== other.children.size) {
+      return false
+    }
+    for (const [key] of this.children) {
+      if (!other.children.has(key)) {
+        return false
+      }
+      if (this.children.get(key).value !== other.children.get(key).value) {
+        return false
+      }
+      if (!this.children.get(key).childrenAreEqual(other.children.get(key))) {
+        return false
+      }
+    }
+    return true
+  }
+
+  isEqual (other) {
+    if (this === other) {
+      return true
+    }
+    if (!other) {
+      return false
+    }
+    if (this.key !== other.key || this.value !== other.value) {
+      return false
+    }
+    if (!this.childrenAreEqual(other)) {
+      return false
+    }
+    if (!this.parent) {
+      return !other.parent
+    }
+    return this.parent.isEqual(other.parent)
+  }
+
   getEdgeRule (edge) {
     for (const rule of this.ruleset.values()) {
       if (rule.name !== edge.name) {
@@ -142,6 +180,123 @@ class OverrideSet {
 
     return ruleset
   }
+
+  static findSpecificOverrideSet (first, second) {
+    for (let overrideSet = second; overrideSet; overrideSet = overrideSet.parent) {
+      if (overrideSet.isEqual(first)) {
+        return second
+      }
+    }
+    for (let overrideSet = first; overrideSet; overrideSet = overrideSet.parent) {
+      if (overrideSet.isEqual(second)) {
+        return first
+      }
+    }
+
+    // The override sets are incomparable (e.g. siblings like the "react" and "react-dom" children of the root override set). Check if they have semantically conflicting rules before treating this as an error.
+    if (this.haveConflictingRules(first, second)) {
+      log.silly('Conflicting override sets', first, second)
+      return undefined
+    }
+
+    // The override sets are structurally incomparable but have compatible rules. Fall back to their nearest common ancestor so the node still has a valid override set.
+    return this.findCommonAncestor(first, second)
+  }
+
+  static findCommonAncestor (first, second) {
+    const firstAncestors = []
+    for (const ancestor of first.ancestry()) {
+      firstAncestors.push(ancestor)
+    }
+    for (const secondAnc of second.ancestry()) {
+      for (const firstAnc of firstAncestors) {
+        if (firstAnc.isEqual(secondAnc)) {
+          return firstAnc
+        }
+      }
+    }
+    return null
+  }
+
+  static doOverrideSetsConflict (first, second) {
+    // If override sets contain one another then we can try to use the more specific one.
+    // If neither one is more specific, check for semantic conflicts.
+    const specificSet = this.findSpecificOverrideSet(first, second)
+    if (specificSet !== undefined) {
+      // One contains the other, so no conflict
+      return false
+    }
+
+    // The override sets are structurally incomparable, but this doesn't necessarily
+    // mean they conflict. We need to check if they have conflicting version requirements
+    // for any package that appears in both rulesets.
+    return this.haveConflictingRules(first, second)
+  }
+
+  static haveConflictingRules (first, second) {
+    // Get all rules from both override sets
+    const firstRules = first.ruleset
+    const secondRules = second.ruleset
+
+    // Check each package that appears in both rulesets
+    for (const [key, firstRule] of firstRules) {
+      const secondRule = secondRules.get(key)
+      if (!secondRule) {
+        // Package only appears in one ruleset, no conflict
+        continue
+      }
+
+      // Same rule object means no conflict
+      if (firstRule === secondRule || firstRule.isEqual(secondRule)) {
+        continue
+      }
+
+      // Both rulesets have rules for this package with different values.
+      // Check if the version requirements are actually incompatible.
+      const firstValue = firstRule.value
+      const secondValue = secondRule.value
+
+      // If either value is a reference (starts with $), we can't determine
+      // compatibility here - the reference might resolve to compatible versions.
+      // We defer to runtime resolution rather than failing early.
+      if (firstValue.startsWith('$') || secondValue.startsWith('$')) {
+        continue
+      }
+
+      // Check if the version ranges are compatible using semver
+      // If both specify version ranges, they conflict only if they have no overlap
+      try {
+        const firstSpec = npa(`${firstRule.name}@${firstValue}`)
+        const secondSpec = npa(`${secondRule.name}@${secondValue}`)
+
+        // For range/version types, check if they intersect
+        if ((firstSpec.type === 'range' || firstSpec.type === 'version') &&
+            (secondSpec.type === 'range' || secondSpec.type === 'version')) {
+          // Check if the ranges intersect
+          const firstRange = firstSpec.fetchSpec
+          const secondRange = secondSpec.fetchSpec
+
+          // If the ranges don't intersect, we have a real conflict
+          if (!semver.intersects(firstRange, secondRange)) {
+            log.silly('Found conflicting override rules', {
+              package: firstRule.name,
+              first: firstValue,
+              second: secondValue,
+            })
+            return true
+          }
+        }
+        // For other types (git, file, directory, tag), we can't easily determine
+        // compatibility, so we conservatively assume no conflict
+      } catch {
+        // If we can't parse the specs, conservatively assume no conflict
+        // Real conflicts will be caught during dependency resolution
+      }
+    }
+
+    // No conflicting rules found
+    return false
+  }
 }
 
 module.exports = OverrideSet

package/lib/query-selector-all.js

@@ -785,9 +785,14 @@ const hasParent = (node, compareNodes) => {
       compareNode = compareNode.target
     }
 
-    // follows logical parent for link anscestors
+    // Follows logical parent for link ancestors (e.g. workspaces whose target lives outside node_modules).
+    // Only match if the node has a link whose parent is the compareNode. Without this check, nodes deep in the store (linked strategy) would incorrectly match as children of root via their fsParent chain.
     if (node.isTop && (node.resolveParent === compareNode)) {
-      return true
+      for (const link of node.linksIn) {
+        if (link.parent === compareNode) {
+          return true
+        }
+      }
     }
     // follows edges-in to check if they match a possible parent
     for (const edge of node.edgesIn) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/arborist",
-  "version": "8.0.2",
+  "version": "8.0.4",
   "description": "Manage node_modules trees",
   "dependencies": {
     "@isaacs/string-locale-compare": "^1.1.0",