@pnpm/resolving.git-resolver 1100.1.16 → 1100.1.17

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @pnpm/git-resolver
 
+## 1100.1.17
+
+### Patch Changes
+
+- A git dependency whose `git ls-remote` fails now reports the `ERR_PNPM_GIT_RESOLVE_FAILED` code, naming the dependency instead of printing a bare `git` invocation, with credentials in the repository URL redacted. A specifier that does not ask for SSH resolves over HTTPS, because the URL recorded in the lockfile has to work on every machine that installs it, so the error explains how to substitute the transport on a machine that can only reach the host over SSH (`git config --global url."git@<host>:".insteadOf "https://<host>/"`) [#13743](https://github.com/pnpm/pnpm/issues/13743).
+
+  A missing `git` executable is reported as one, instead of surfacing the raw failure to start the process.
+
+  Credentials embedded in a git specifier are redacted from the "Could not resolve \<ref\> to a commit of \<repo\>" errors too.
+
+  Resolving a public repository makes one `git ls-remote` round-trip instead of two.
+
+- An `ssh://` git dependency pointing at a bracketed IPv6 host, such as `ssh://[::1]/repo.git`, is resolved now. Its colons were read as an SCP-style path separator, which turned the address into `[:/1]` and left the specifier unresolvable. Applies to both the TypeScript CLI and pacquet.
+
+  In the TypeScript CLI, an `ssh://` git dependency written without user info — `ssh://git.example.com/team/repo.git`, `git+ssh://git.example.com:2222/team/repo.git` — no longer fails with `TypeError: Cannot read properties of undefined (reading 'includes')`. Only the `user@host` form worked before.
+
+- Updated dependencies:
+  - @pnpm/error@1100.1.2
+  - @pnpm/network.fetch@1100.1.12
+
 ## 1100.1.16
 
 ### Patch Changes

package/lib/index.js

@@ -1,4 +1,6 @@
-import { PnpmError } from '@pnpm/error';
+import assert from 'node:assert';
+import util from 'node:util';
+import { PnpmError, redactAndSanitize } from '@pnpm/error';
 import semver from 'semver';
 import { createGitHostedPkgId } from './createGitHostedPkgId.js';
 import { lsRemote } from './lsRemote.js';
@@ -33,7 +35,14 @@ export function createGitResolver(opts) {
         const bareSpecifier = parsedSpec.gitCommittish == null || parsedSpec.gitCommittish === ''
             ? 'HEAD'
             : parsedSpec.gitCommittish;
-        const commit = await resolveRef(parsedSpec.fetchSpec, bareSpecifier, parsedSpec.gitRange);
+        let commit;
+        try {
+            commit = await resolveRef(parsedSpec.fetchSpec, bareSpecifier, parsedSpec.gitRange);
+        }
+        catch (err) {
+            assert(util.types.isNativeError(err));
+            throw gitResolveError(err, wantedDependency.bareSpecifier, parsedSpec.fetchSpec);
+        }
         let resolution;
         if ((parsedSpec.hosted != null) && !isSsh(parsedSpec.fetchSpec)) {
             // don't use tarball for ssh url, they are likely private repo
@@ -135,7 +144,7 @@ function resolveRefFromRefs(refs, repo, ref, committish, range) {
                 commitId = commits[0];
             }
             else {
-                throw new Error(`Could not resolve ${ref} to a commit of ${repo}.`);
+                throw new Error(`Could not resolve ${ref} to a commit of ${redactAndSanitize(repo)}.`);
             }
         }
         return commitId;
@@ -155,11 +164,50 @@ function resolveRefFromRefs(refs, repo, ref, committish, range) {
             (refs[`refs/tags/${refVTag}^{}`] || // prefer annotated tags
                 refs[`refs/tags/${refVTag}`]);
         if (!commitId) {
-            throw new Error(`Could not resolve ${range} to a commit of ${repo}. Available versions are: ${vTags.join(', ')}`);
+            throw new Error(`Could not resolve ${range} to a commit of ${redactAndSanitize(repo)}. Available versions are: ${vTags.join(', ')}`);
         }
         return commitId;
     }
 }
+/**
+ * Restate a failed `git ls-remote` as `ERR_PNPM_GIT_RESOLVE_FAILED`, naming the
+ * dependency it was resolving. Errors that describe the refs the remote did
+ * return (an unknown ref, an ambiguous commit-ish) already say which repository
+ * they came from and are left alone.
+ */
+function gitResolveError(err, bareSpecifier, repo) {
+    if (err.code !== 'ERR_PNPM_GIT_LS_REMOTE_FAILED')
+        return err;
+    return new PnpmError('GIT_RESOLVE_FAILED', `Failed to resolve git dependency "${redactAndSanitize(bareSpecifier)}": ${err.message}`, { hint: httpsTransportHint(repo) });
+}
+/**
+ * Guidance for a specifier that resolved over HTTPS on a machine whose git
+ * cannot use that transport, or `undefined` when the resolution already went
+ * over SSH — there, the transport that failed is the one the specifier asked
+ * for.
+ *
+ * Substituting the transport is git's job rather than pnpm's: the URL pnpm
+ * records has to work for every machine that installs the lockfile, while
+ * `insteadOf` rewrites it for this one only.
+ */
+function httpsTransportHint(repo) {
+    let url;
+    try {
+        url = new URL(repo);
+    }
+    catch {
+        return undefined;
+    }
+    if (url.protocol !== 'https:' && url.protocol !== 'http:')
+        return undefined;
+    const host = redactAndSanitize(url.host);
+    const hostname = redactAndSanitize(url.hostname);
+    return `pnpm resolves this specifier over HTTPS because it does not ask for SSH, and the URL it records has to work on every machine that installs the lockfile.
+
+If git can only reach ${hostname} over SSH here, substitute the transport locally, leaving the recorded URL alone:
+
+    git config --global url."git@${hostname}:".insteadOf "${url.protocol}//${host}/"`;
+}
 function isSsh(gitSpec) {
     return gitSpec.slice(0, 10) === 'git+ssh://' ||
         gitSpec.slice(0, 4) === 'git@';

package/lib/lsRemote.d.ts

@@ -4,6 +4,8 @@
  * ls-remote invocations must go through this function to keep that guarantee.
  *
  * Failed runs are retried immediately, matching the Rust runner's policy.
+ * A run that fails every attempt throws `ERR_PNPM_GIT_LS_REMOTE_FAILED`,
+ * which the git resolver restates with the dependency it was resolving.
  */
 export declare function lsRemote(args: string[], opts: {
     retries: number;

package/lib/lsRemote.js

@@ -1,3 +1,4 @@
+import { PnpmError, redactAndSanitizeMultiline } from '@pnpm/error';
 import { safeExeca as execa } from 'execa';
 /**
  * Runs `git ls-remote` with interactive credential prompts disabled, so it
@@ -5,6 +6,8 @@ import { safeExeca as execa } from 'execa';
  * ls-remote invocations must go through this function to keep that guarantee.
  *
  * Failed runs are retried immediately, matching the Rust runner's policy.
+ * A run that fails every attempt throws `ERR_PNPM_GIT_LS_REMOTE_FAILED`,
+ * which the git resolver restates with the dependency it was resolving.
  */
 export async function lsRemote(args, opts) {
     let lastErr;
@@ -21,6 +24,23 @@ export async function lsRemote(args, opts) {
             lastErr = err;
         }
     }
-    throw lastErr;
+    throw lsRemoteError(lastErr);
+}
+/**
+ * git's stderr is untrusted: the repository URL it echoes back can carry
+ * `user:pass@` credentials, so it goes through
+ * {@link redactAndSanitizeMultiline} rather than being restated verbatim.
+ */
+function lsRemoteError(err) {
+    return new PnpmError('GIT_LS_REMOTE_FAILED', `git ls-remote failed: ${redactAndSanitizeMultiline(lsRemoteFailureDetail(err))}`);
+}
+function lsRemoteFailureDetail(err) {
+    if (err.code === 'ENOENT') {
+        return '`git` executable not found on PATH. Install git to resolve git-hosted packages.';
+    }
+    const stderr = err.stderr?.trim();
+    if (stderr != null && stderr !== '')
+        return stderr;
+    return err.message ?? String(err);
 }
 //# sourceMappingURL=lsRemote.js.map

package/lib/parseBareSpecifier.js

@@ -56,9 +56,16 @@ async function fromHostedGit(hosted, dispatcherOptions) {
     // (`shortcut`, `https`, ...) an SSH remote was never asked for, and recording one
     // in the lockfile breaks installs in environments without SSH keys, so every
     // HTTPS transport is exhausted first.
+    //
+    // Such a specifier therefore resolves over HTTPS whether or not git can reach
+    // the host that way on this machine, and its HTTPS access is not probed at all:
+    // the probe could not change what is recorded, and a machine that reaches the
+    // host only over SSH substitutes the transport itself through git's
+    // `url.<base>.insteadOf`. Only an explicit SSH URL, which HTTPS may displace,
+    // is worth the round-trip.
     const preferSsh = hosted.default === 'sshurl';
     const repoIsPublic = httpsUrl != null && await isRepoPublic(httpsUrl, dispatcherOptions);
-    if (httpsUrl && repoIsPublic && await accessRepository(httpsUrl)) {
+    if (httpsUrl && repoIsPublic && (!preferSsh || await accessRepository(httpsUrl))) {
         fetchSpec = httpsUrl;
     }
     if (!fetchSpec && preferSsh && sshUrl && await accessRepository(sshUrl)) {
@@ -172,8 +179,12 @@ function correctUrl(gitUrl) {
             _gitUrl = _gitUrl.slice(0, hashIndex);
         }
         const [auth, ...pathname] = _gitUrl.slice(6).split('/');
-        const [, host] = auth.split('@');
-        if (host.includes(':') && !/:\d+$/.test(host)) {
+        const userInfoEnd = auth.lastIndexOf('@');
+        const host = userInfoEnd === -1 ? auth : auth.slice(userInfoEnd + 1);
+        // The colons of a bracketed IPv6 literal belong to the address.
+        const bracketEnd = host.startsWith('[') ? host.indexOf(']') : -1;
+        const afterHost = bracketEnd === -1 ? host : host.slice(bracketEnd + 1);
+        if (afterHost.includes(':') && !/:\d+$/.test(afterHost)) {
             const authArr = auth.split(':');
             const protocol = gitUrl.split('://')[0];
             gitUrl = `${protocol}://${authArr.slice(0, -1).join(':') + '/' + authArr[authArr.length - 1]}${pathname.length ? '/' + pathname.join('/') : ''}${hash}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.git-resolver",
-  "version": "1100.1.16",
+  "version": "1100.1.17",
   "description": "Resolver for git-hosted packages",
   "keywords": [
     "pnpm",
@@ -29,8 +29,8 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/error": "1100.1.1",
-    "@pnpm/network.fetch": "1100.1.11",
+    "@pnpm/error": "1100.1.2",
+    "@pnpm/network.fetch": "1100.1.12",
     "@pnpm/resolving.resolver-base": "1101.1.0",
     "execa": "npm:safe-execa@0.3.0",
     "hosted-git-info": "npm:@pnpm/hosted-git-info@1.0.0",
@@ -38,7 +38,7 @@
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/resolving.git-resolver": "1100.1.16",
+    "@pnpm/resolving.git-resolver": "1100.1.17",
     "@types/hosted-git-info": "^3.0.5",
     "@types/is-windows": "^1.0.2",
     "@types/semver": "7.8.0",