@pnpm/resolving.git-resolver 1100.1.15 → 1100.1.17

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # @pnpm/git-resolver
 
+## 1100.1.17
+
+### Patch Changes
+
+- A git dependency whose `git ls-remote` fails now reports the `ERR_PNPM_GIT_RESOLVE_FAILED` code, naming the dependency instead of printing a bare `git` invocation, with credentials in the repository URL redacted. A specifier that does not ask for SSH resolves over HTTPS, because the URL recorded in the lockfile has to work on every machine that installs it, so the error explains how to substitute the transport on a machine that can only reach the host over SSH (`git config --global url."git@<host>:".insteadOf "https://<host>/"`) [#13743](https://github.com/pnpm/pnpm/issues/13743).
+
+  A missing `git` executable is reported as one, instead of surfacing the raw failure to start the process.
+
+  Credentials embedded in a git specifier are redacted from the "Could not resolve \<ref\> to a commit of \<repo\>" errors too.
+
+  Resolving a public repository makes one `git ls-remote` round-trip instead of two.
+
+- An `ssh://` git dependency pointing at a bracketed IPv6 host, such as `ssh://[::1]/repo.git`, is resolved now. Its colons were read as an SCP-style path separator, which turned the address into `[:/1]` and left the specifier unresolvable. Applies to both the TypeScript CLI and pacquet.
+
+  In the TypeScript CLI, an `ssh://` git dependency written without user info — `ssh://git.example.com/team/repo.git`, `git+ssh://git.example.com:2222/team/repo.git` — no longer fails with `TypeError: Cannot read properties of undefined (reading 'includes')`. Only the `user@host` form worked before.
+
+- Updated dependencies:
+  - @pnpm/error@1100.1.2
+  - @pnpm/network.fetch@1100.1.12
+
+## 1100.1.16
+
+### Patch Changes
+
+- Fixed a CI regression where `github:owner/repo` dependencies (and other shorthand Git specifiers) would fail to install with `Permission denied (publickey)` on CI runners that lack SSH keys. The Git resolver no longer records an SSH URL unless the user explicitly wrote one (e.g. `git+ssh://` or `git@host:...`):
+
+  - The repository visibility probe (an HTTP HEAD request) now retries transient failures such as `429 Too Many Requests`, so host throttling of CI runners is no longer mistaken for a private repository.
+  - For non-SSH specifiers, anonymous HTTPS `git ls-remote` access is now tried before SSH, so a public repository whose visibility probe fails still resolves to a portable HTTPS URL instead of an SSH URL that only works where SSH keys are configured.
+  - When every probe fails, the resolver falls back to HTTPS for shorthand and HTTPS-style specifiers, and only guesses SSH when the user explicitly provided an SSH URL.
+  - A repository that could not be confirmed public is no longer resolved to the host's anonymous archive URL (e.g. `codeload.github.com`, which would fail to download for a private repository); it stays a regular `git` resolution so installs can use ambient Git credentials such as credential helpers and tokens.
+
+  Note that a private repository that is reachable both over authenticated HTTPS and over SSH now resolves to its HTTPS URL, where previous versions recorded the SSH URL.
+
+  Fixes [pnpm/pnpm#13276](https://github.com/pnpm/pnpm/issues/13276).
+
+  <!-- cspell:ignore publickey -->
+
+- Resolving a private git repository no longer blocks on an interactive credential prompt: `git ls-remote` now fails fast with an authentication error when git has no credentials for the repository [#13522](https://github.com/pnpm/pnpm/issues/13522).
+
 ## 1100.1.15
 
 ### Patch Changes

package/lib/index.js

@@ -1,4 +1,6 @@
-import { PnpmError } from '@pnpm/error';
+import assert from 'node:assert';
+import util from 'node:util';
+import { PnpmError, redactAndSanitize } from '@pnpm/error';
 import semver from 'semver';
 import { createGitHostedPkgId } from './createGitHostedPkgId.js';
 import { lsRemote } from './lsRemote.js';
@@ -33,7 +35,14 @@ export function createGitResolver(opts) {
         const bareSpecifier = parsedSpec.gitCommittish == null || parsedSpec.gitCommittish === ''
             ? 'HEAD'
             : parsedSpec.gitCommittish;
-        const commit = await resolveRef(parsedSpec.fetchSpec, bareSpecifier, parsedSpec.gitRange);
+        let commit;
+        try {
+            commit = await resolveRef(parsedSpec.fetchSpec, bareSpecifier, parsedSpec.gitRange);
+        }
+        catch (err) {
+            assert(util.types.isNativeError(err));
+            throw gitResolveError(err, wantedDependency.bareSpecifier, parsedSpec.fetchSpec);
+        }
         let resolution;
         if ((parsedSpec.hosted != null) && !isSsh(parsedSpec.fetchSpec)) {
             // don't use tarball for ssh url, they are likely private repo
@@ -99,7 +108,6 @@ export async function getRepoRefs(repo, ref) {
         // This is needed because annotated tags have their own SHA, and we need the commit SHA they point to
         gitArgs.push(`${ref}^{}`);
     }
-    // graceful-git by default retries 10 times, reduce to single retry
     const result = await lsRemote(gitArgs, { retries: 1 });
     const refs = {};
     for (const line of result.stdout.split('\n')) {
@@ -136,7 +144,7 @@ function resolveRefFromRefs(refs, repo, ref, committish, range) {
                 commitId = commits[0];
             }
             else {
-                throw new Error(`Could not resolve ${ref} to a commit of ${repo}.`);
+                throw new Error(`Could not resolve ${ref} to a commit of ${redactAndSanitize(repo)}.`);
             }
         }
         return commitId;
@@ -156,11 +164,50 @@ function resolveRefFromRefs(refs, repo, ref, committish, range) {
             (refs[`refs/tags/${refVTag}^{}`] || // prefer annotated tags
                 refs[`refs/tags/${refVTag}`]);
         if (!commitId) {
-            throw new Error(`Could not resolve ${range} to a commit of ${repo}. Available versions are: ${vTags.join(', ')}`);
+            throw new Error(`Could not resolve ${range} to a commit of ${redactAndSanitize(repo)}. Available versions are: ${vTags.join(', ')}`);
         }
         return commitId;
     }
 }
+/**
+ * Restate a failed `git ls-remote` as `ERR_PNPM_GIT_RESOLVE_FAILED`, naming the
+ * dependency it was resolving. Errors that describe the refs the remote did
+ * return (an unknown ref, an ambiguous commit-ish) already say which repository
+ * they came from and are left alone.
+ */
+function gitResolveError(err, bareSpecifier, repo) {
+    if (err.code !== 'ERR_PNPM_GIT_LS_REMOTE_FAILED')
+        return err;
+    return new PnpmError('GIT_RESOLVE_FAILED', `Failed to resolve git dependency "${redactAndSanitize(bareSpecifier)}": ${err.message}`, { hint: httpsTransportHint(repo) });
+}
+/**
+ * Guidance for a specifier that resolved over HTTPS on a machine whose git
+ * cannot use that transport, or `undefined` when the resolution already went
+ * over SSH — there, the transport that failed is the one the specifier asked
+ * for.
+ *
+ * Substituting the transport is git's job rather than pnpm's: the URL pnpm
+ * records has to work for every machine that installs the lockfile, while
+ * `insteadOf` rewrites it for this one only.
+ */
+function httpsTransportHint(repo) {
+    let url;
+    try {
+        url = new URL(repo);
+    }
+    catch {
+        return undefined;
+    }
+    if (url.protocol !== 'https:' && url.protocol !== 'http:')
+        return undefined;
+    const host = redactAndSanitize(url.host);
+    const hostname = redactAndSanitize(url.hostname);
+    return `pnpm resolves this specifier over HTTPS because it does not ask for SSH, and the URL it records has to work on every machine that installs the lockfile.
+
+If git can only reach ${hostname} over SSH here, substitute the transport locally, leaving the recorded URL alone:
+
+    git config --global url."git@${hostname}:".insteadOf "${url.protocol}//${host}/"`;
+}
 function isSsh(gitSpec) {
     return gitSpec.slice(0, 10) === 'git+ssh://' ||
         gitSpec.slice(0, 4) === 'git@';

package/lib/lsRemote.d.ts

@@ -2,6 +2,10 @@
  * Runs `git ls-remote` with interactive credential prompts disabled, so it
  * fails fast on private repos instead of blocking on user input. All
  * ls-remote invocations must go through this function to keep that guarantee.
+ *
+ * Failed runs are retried immediately, matching the Rust runner's policy.
+ * A run that fails every attempt throws `ERR_PNPM_GIT_LS_REMOTE_FAILED`,
+ * which the git resolver restates with the dependency it was resolving.
  */
 export declare function lsRemote(args: string[], opts: {
     retries: number;

package/lib/lsRemote.js

@@ -1,15 +1,46 @@
-import { gracefulGit as git } from 'graceful-git';
+import { PnpmError, redactAndSanitizeMultiline } from '@pnpm/error';
+import { safeExeca as execa } from 'execa';
 /**
  * Runs `git ls-remote` with interactive credential prompts disabled, so it
  * fails fast on private repos instead of blocking on user input. All
  * ls-remote invocations must go through this function to keep that guarantee.
+ *
+ * Failed runs are retried immediately, matching the Rust runner's policy.
+ * A run that fails every attempt throws `ERR_PNPM_GIT_LS_REMOTE_FAILED`,
+ * which the git resolver restates with the dependency it was resolving.
  */
 export async function lsRemote(args, opts) {
-    return git(['ls-remote', ...args], {
-        retries: opts.retries,
-        // Snapshotted per call so changes to auth/proxy env vars made by a
-        // long-lived host process are picked up.
-        env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
-    });
+    let lastErr;
+    for (let attempt = 0; attempt <= opts.retries; attempt++) {
+        try {
+            const { stdout } = await execa('git', ['ls-remote', ...args], {
+                // Snapshotted per call so changes to auth/proxy env vars made by a
+                // long-lived host process are picked up.
+                env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+            });
+            return { stdout: stdout };
+        }
+        catch (err) {
+            lastErr = err;
+        }
+    }
+    throw lsRemoteError(lastErr);
+}
+/**
+ * git's stderr is untrusted: the repository URL it echoes back can carry
+ * `user:pass@` credentials, so it goes through
+ * {@link redactAndSanitizeMultiline} rather than being restated verbatim.
+ */
+function lsRemoteError(err) {
+    return new PnpmError('GIT_LS_REMOTE_FAILED', `git ls-remote failed: ${redactAndSanitizeMultiline(lsRemoteFailureDetail(err))}`);
+}
+function lsRemoteFailureDetail(err) {
+    if (err.code === 'ENOENT') {
+        return '`git` executable not found on PATH. Install git to resolve git-hosted packages.';
+    }
+    const stderr = err.stderr?.trim();
+    if (stderr != null && stderr !== '')
+        return stderr;
+    return err.message ?? String(err);
 }
 //# sourceMappingURL=lsRemote.js.map

package/lib/parseBareSpecifier.js

@@ -49,53 +49,53 @@ function urlToFetchSpec(url) {
 }
 async function fromHostedGit(hosted, dispatcherOptions) {
     let fetchSpec = null;
-    // try git/https url before fallback to ssh url
-    const gitHttpsUrl = hosted.https({ noCommittish: true, noGitPlus: true });
-    if (gitHttpsUrl && await isRepoPublic(gitHttpsUrl, dispatcherOptions) && await accessRepository(gitHttpsUrl)) {
-        fetchSpec = gitHttpsUrl;
+    const httpsUrl = hosted.https({ noCommittish: true, noGitPlus: true });
+    const sshUrl = hosted.ssh({ noCommittish: true });
+    // SSH is probed before the HTTPS fallbacks (and used as the last-resort guess)
+    // only when the user explicitly wrote an SSH URL. For every other representation
+    // (`shortcut`, `https`, ...) an SSH remote was never asked for, and recording one
+    // in the lockfile breaks installs in environments without SSH keys, so every
+    // HTTPS transport is exhausted first.
+    //
+    // Such a specifier therefore resolves over HTTPS whether or not git can reach
+    // the host that way on this machine, and its HTTPS access is not probed at all:
+    // the probe could not change what is recorded, and a machine that reaches the
+    // host only over SSH substitutes the transport itself through git's
+    // `url.<base>.insteadOf`. Only an explicit SSH URL, which HTTPS may displace,
+    // is worth the round-trip.
+    const preferSsh = hosted.default === 'sshurl';
+    const repoIsPublic = httpsUrl != null && await isRepoPublic(httpsUrl, dispatcherOptions);
+    if (httpsUrl && repoIsPublic && (!preferSsh || await accessRepository(httpsUrl))) {
+        fetchSpec = httpsUrl;
     }
-    else {
-        const gitSshUrl = hosted.ssh({ noCommittish: true });
-        if (gitSshUrl && await accessRepository(gitSshUrl)) {
-            fetchSpec = gitSshUrl;
-        }
+    if (!fetchSpec && preferSsh && sshUrl && await accessRepository(sshUrl)) {
+        fetchSpec = sshUrl;
     }
-    if (!fetchSpec) {
-        const httpsUrl = hosted.https({ noGitPlus: true, noCommittish: true });
-        if (httpsUrl) {
-            if ((hosted.auth || !await isRepoPublic(httpsUrl, dispatcherOptions)) && await accessRepository(httpsUrl)) {
-                return {
-                    fetchSpec: httpsUrl,
-                    hosted: {
-                        ...hosted,
-                        _fill: hosted._fill,
-                        tarball: undefined,
-                    },
-                    normalizedBareSpecifier: `git+${httpsUrl}`,
-                    ...parseGitParams(hosted.committish),
-                };
-            }
-            else {
-                try {
-                    // when git ls-remote private repo, it asks for login credentials.
-                    // use HTTP HEAD request to test whether this is a private repo, to avoid login prompt.
-                    // this is very similar to yarn classic's behavior.
-                    // npm instead tries git ls-remote directly which prompts user for login credentials.
-                    // HTTP HEAD on https://domain/user/repo, strip out ".git"
-                    const response = await fetchWithDispatcher(httpsUrl.replace(/\.git$/, ''), { method: 'HEAD', redirect: 'manual', retry: { retries: 0 }, dispatcherOptions });
-                    if (response.ok) {
-                        fetchSpec = httpsUrl;
-                    }
-                }
-                catch {
-                    // ignore
-                }
-            }
+    if (!fetchSpec && httpsUrl) {
+        if ((hosted.auth || !repoIsPublic) && await accessRepository(httpsUrl)) {
+            // Reachable over HTTPS without being provably public, so resolve as
+            // `type: git` against this exact URL: the host's archive endpoint would
+            // carry neither the URL's credentials nor ambient ones (helpers, tokens).
+            return {
+                fetchSpec: httpsUrl,
+                hosted: {
+                    ...hosted,
+                    _fill: hosted._fill,
+                    tarball: undefined,
+                },
+                normalizedBareSpecifier: `git+${httpsUrl}`,
+                ...parseGitParams(hosted.committish),
+            };
+        }
+        if (repoIsPublic) {
+            fetchSpec = httpsUrl;
         }
     }
+    if (!fetchSpec && !preferSsh && sshUrl && await accessRepository(sshUrl)) {
+        fetchSpec = sshUrl;
+    }
     if (!fetchSpec) {
-        // use ssh url for likely private repo
-        fetchSpec = hosted.sshurl({ noCommittish: true });
+        fetchSpec = preferSsh ? hosted.sshurl({ noCommittish: true }) : httpsUrl;
     }
     return {
         fetchSpec: fetchSpec,
@@ -103,7 +103,10 @@ async function fromHostedGit(hosted, dispatcherOptions) {
             ...hosted,
             tarballtemplate: hosted.type === 'gitlab' ? gitlabTarballTemplate : hosted.tarballtemplate,
             _fill: hosted._fill,
-            tarball: hosted.tarball,
+            // Same rationale as the early return above: without proof that the repo
+            // is public, the host's anonymous archive endpoint cannot be assumed to
+            // work, so the resolution must stay `type: git`.
+            tarball: repoIsPublic ? hosted.tarball : undefined,
         },
         normalizedBareSpecifier: hosted.shortcut(),
         ...parseGitParams(hosted.committish),
@@ -116,9 +119,20 @@ function gitlabTarballTemplate({ domain, user, project, committish }) {
     const ref = committish ? encodeURIComponent(committish) : 'HEAD';
     return `https://${domain}/${user}/${project}/-/archive/${ref}/${project}-${ref}.tar.gz`;
 }
+// An HTTP HEAD on the project page (without ".git") instead of `git ls-remote`:
+// probing a private repo with ls-remote would trigger a credential prompt. This is
+// very similar to yarn classic's behavior; npm instead tries git ls-remote directly,
+// which prompts for login credentials. Transient failures (429/5xx/network errors)
+// are retried by the fetch layer so registry throttling of CI runners is not
+// mistaken for a private repository.
 async function isRepoPublic(httpsUrl, dispatcherOptions) {
     try {
-        const response = await fetchWithDispatcher(httpsUrl.replace(/\.git$/, ''), { method: 'HEAD', redirect: 'manual', retry: { retries: 0 }, dispatcherOptions });
+        const response = await fetchWithDispatcher(httpsUrl.replace(/\.git$/, ''), {
+            method: 'HEAD',
+            redirect: 'manual',
+            retry: { retries: 2, factor: 2, minTimeout: 500, maxTimeout: 2_000 },
+            dispatcherOptions,
+        });
         return response.ok;
     }
     catch {
@@ -165,8 +179,12 @@ function correctUrl(gitUrl) {
             _gitUrl = _gitUrl.slice(0, hashIndex);
         }
         const [auth, ...pathname] = _gitUrl.slice(6).split('/');
-        const [, host] = auth.split('@');
-        if (host.includes(':') && !/:\d+$/.test(host)) {
+        const userInfoEnd = auth.lastIndexOf('@');
+        const host = userInfoEnd === -1 ? auth : auth.slice(userInfoEnd + 1);
+        // The colons of a bracketed IPv6 literal belong to the address.
+        const bracketEnd = host.startsWith('[') ? host.indexOf(']') : -1;
+        const afterHost = bracketEnd === -1 ? host : host.slice(bracketEnd + 1);
+        if (afterHost.includes(':') && !/:\d+$/.test(afterHost)) {
             const authArr = auth.split(':');
             const protocol = gitUrl.split('://')[0];
             gitUrl = `${protocol}://${authArr.slice(0, -1).join(':') + '/' + authArr[authArr.length - 1]}${pathname.length ? '/' + pathname.join('/') : ''}${hash}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.git-resolver",
-  "version": "1100.1.15",
+  "version": "1100.1.17",
   "description": "Resolver for git-hosted packages",
   "keywords": [
     "pnpm",
@@ -29,19 +29,19 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/error": "1100.1.1",
-    "@pnpm/network.fetch": "1100.1.11",
+    "@pnpm/error": "1100.1.2",
+    "@pnpm/network.fetch": "1100.1.12",
     "@pnpm/resolving.resolver-base": "1101.1.0",
-    "graceful-git": "^5.0.0",
+    "execa": "npm:safe-execa@0.3.0",
     "hosted-git-info": "npm:@pnpm/hosted-git-info@1.0.0",
     "semver": "^7.8.5"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/resolving.git-resolver": "1100.1.15",
+    "@pnpm/resolving.git-resolver": "1100.1.17",
     "@types/hosted-git-info": "^3.0.5",
     "@types/is-windows": "^1.0.2",
-    "@types/semver": "7.7.1",
+    "@types/semver": "7.8.0",
     "is-windows": "^1.0.2"
   },
   "engines": {