isolate-package 1.33.0 → 1.35.0

package/src/lib/patches/copy-patches.ts

@@ -2,39 +2,45 @@ import fs from "fs-extra";
 import path from "node:path";
 import { readWantedLockfile as readWantedLockfile_v8 } from "pnpm_lockfile_file_v8";
 import { readWantedLockfile as readWantedLockfile_v9 } from "pnpm_lockfile_file_v9";
-import { useLogger } from "~/lib/logger";
-import { usePackageManager } from "~/lib/package-manager";
-import { collectReachablePackageNames } from "~/lib/registry";
+import { useLogger } from "#/lib/logger";
+import { usePackageManager } from "#/lib/package-manager";
+import { collectReachablePackageNames } from "#/lib/registry";
 import type {
   PackageManifest,
   PackagesRegistry,
   PatchFile,
   PnpmSettings,
-} from "~/lib/types";
+} from "#/lib/types";
 import {
   filterPatchedDependencies,
   getRootRelativeLogPath,
   isRushWorkspace,
   readTypedJson,
   readTypedYamlSync,
-} from "~/lib/utils";
+} from "#/lib/utils";
+import { collectInstalledNamesFromBunLockfile } from "./collect-installed-names-bun";
+import { collectInstalledNamesFromPnpmLockfile } from "./collect-installed-names-pnpm";
 
 export async function copyPatches({
   workspaceRootDir,
+  targetPackageDir,
   targetPackageManifest,
   packagesRegistry,
+  internalDepPackageNames,
   isolateDir,
   includeDevDependencies,
 }: {
   workspaceRootDir: string;
+  targetPackageDir: string;
   targetPackageManifest: PackageManifest;
   packagesRegistry: PackagesRegistry;
+  internalDepPackageNames: string[];
   isolateDir: string;
   includeDevDependencies: boolean;
 }): Promise<Record<string, PatchFile>> {
   const log = useLogger();
 
-  const { name: packageManagerName } = usePackageManager();
+  const { name: packageManagerName, majorVersion } = usePackageManager();
 
   let patchedDependencies: Record<string, string> | undefined;
 
@@ -44,9 +50,9 @@ export async function copyPatches({
    */
   if (packageManagerName === "pnpm") {
     try {
-      const pnpmSettings = readTypedYamlSync<PnpmSettings>(
+      const pnpmSettings = readTypedYamlSync(
         path.join(workspaceRootDir, "pnpm-workspace.yaml"),
-      );
+      ) as PnpmSettings | undefined;
       patchedDependencies = pnpmSettings?.patchedDependencies;
     } catch (error) {
       log.warn(
@@ -67,9 +73,9 @@ export async function copyPatches({
     }
 
     try {
-      const workspaceRootManifest = await readTypedJson<PackageManifest>(
+      const workspaceRootManifest = (await readTypedJson(
         path.join(workspaceRootDir, "package.json"),
-      );
+      )) as PackageManifest;
       /** PNPM stores patches under pnpm.patchedDependencies, Bun at the top level */
       patchedDependencies =
         workspaceRootManifest?.pnpm?.patchedDependencies ??
@@ -102,6 +108,37 @@ export async function copyPatches({
     includeDevDependencies,
   });
 
+  /**
+   * Manifest-based reachability misses external→external transitives because
+   * external manifests aren't loaded here. Walk the package-manager's
+   * lockfile to also pick up those names, so a patch for a deeply-nested
+   * external dep (e.g. `@react-pdf/render` reached via `@react-pdf/renderer`)
+   * survives isolation.
+   */
+  const lockfileInstalledNames =
+    packageManagerName === "pnpm"
+      ? await collectInstalledNamesFromPnpmLockfile({
+          workspaceRootDir,
+          targetPackageDir,
+          internalDepPackageNames,
+          packagesRegistry,
+          majorVersion,
+          includeDevDependencies,
+        })
+      : packageManagerName === "bun"
+        ? collectInstalledNamesFromBunLockfile({
+            workspaceRootDir,
+            targetPackageDir,
+            internalDepPackageNames,
+            packagesRegistry,
+            includeDevDependencies,
+          })
+        : new Set<string>();
+
+  for (const name of lockfileInstalledNames) {
+    reachableDependencyNames.add(name);
+  }
+
   const filteredPatches = filterPatchedDependencies({
     patchedDependencies,
     targetPackageManifest,

package/src/lib/patches/write-isolate-pnpm-workspace.test.ts

@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import type { PatchFile } from "~/lib/types";
+import type { PatchFile } from "#/lib/types";
 import { writeIsolatePnpmWorkspace } from "./write-isolate-pnpm-workspace";
 
 vi.mock("fs-extra", () => ({
@@ -8,14 +8,14 @@ vi.mock("fs-extra", () => ({
   },
 }));
 
-vi.mock("~/lib/utils", () => ({
+vi.mock("#/lib/utils", () => ({
   readTypedYamlSync: vi.fn(),
   writeTypedYamlSync: vi.fn(),
 }));
 
 const fs = vi.mocked((await import("fs-extra")).default);
 const { readTypedYamlSync, writeTypedYamlSync } = vi.mocked(
-  await import("~/lib/utils"),
+  await import("#/lib/utils"),
 );
 
 const workspaceRootDir = "/workspace";
@@ -139,6 +139,86 @@ describe("writeIsolatePnpmWorkspace", () => {
     );
   });
 
+  /**
+   * Regression test for issue #189: pnpm 11 expresses the build-script policy
+   * via `allowBuilds` in pnpm-workspace.yaml (and removes the older
+   * `pnpm.onlyBuiltDependencies` / `ignoredBuiltDependencies` fields from
+   * package.json). The verbatim copy must carry that field — along with other
+   * workspace-level settings like `minimumReleaseAge` — into the isolate
+   * output so downstream `pnpm install` honors the same policy.
+   */
+  it("preserves pnpm 11 workspace settings (allowBuilds, minimumReleaseAge) when no patches are involved", () => {
+    readTypedYamlSync.mockReturnValue({
+      packages: ["apps/*", "packages/*"],
+      allowBuilds: {
+        puppeteer: true,
+        esbuild: true,
+      },
+      minimumReleaseAge: 10_080,
+    });
+
+    writeIsolatePnpmWorkspace({
+      workspaceRootDir,
+      isolateDir,
+      copiedPatches: {},
+    });
+
+    /**
+     * With no patchedDependencies in the source yaml, the file is copied
+     * verbatim — preserving `allowBuilds` and any other top-level settings.
+     */
+    expect(writeTypedYamlSync).not.toHaveBeenCalled();
+    expect(fs.copyFileSync).toHaveBeenCalledWith(
+      "/workspace/pnpm-workspace.yaml",
+      "/workspace/isolate/pnpm-workspace.yaml",
+    );
+  });
+
+  /**
+   * When patches are being filtered, the rewrite path must still carry
+   * `allowBuilds` into the output yaml — otherwise pnpm 11's build-script
+   * policy is silently dropped.
+   */
+  it("preserves allowBuilds when rewriting to filter patchedDependencies", () => {
+    readTypedYamlSync.mockReturnValue({
+      packages: ["apps/*", "packages/*"],
+      allowBuilds: {
+        puppeteer: true,
+      },
+      patchedDependencies: {
+        "lodash@4.17.21": "patches/lodash@4.17.21.patch",
+        "axios@1.6.0": "patches/axios@1.6.0.patch",
+      },
+    });
+
+    const copiedPatches: Record<string, PatchFile> = {
+      "lodash@4.17.21": {
+        path: "patches/lodash@4.17.21.patch",
+        hash: "abc",
+      },
+    };
+
+    writeIsolatePnpmWorkspace({
+      workspaceRootDir,
+      isolateDir,
+      copiedPatches,
+    });
+
+    expect(fs.copyFileSync).not.toHaveBeenCalled();
+    expect(writeTypedYamlSync).toHaveBeenCalledWith(
+      "/workspace/isolate/pnpm-workspace.yaml",
+      {
+        packages: ["apps/*", "packages/*"],
+        allowBuilds: {
+          puppeteer: true,
+        },
+        patchedDependencies: {
+          "lodash@4.17.21": "patches/lodash@4.17.21.patch",
+        },
+      },
+    );
+  });
+
   it("copies verbatim when every patch is kept (preserving comments and order)", () => {
     readTypedYamlSync.mockReturnValue({
       packages: ["packages/*"],

package/src/lib/patches/write-isolate-pnpm-workspace.ts

@@ -1,8 +1,8 @@
 import fs from "fs-extra";
 import path from "node:path";
-import { useLogger } from "~/lib/logger";
-import type { PatchFile, PnpmSettings } from "~/lib/types";
-import { readTypedYamlSync, writeTypedYamlSync } from "~/lib/utils";
+import { useLogger } from "#/lib/logger";
+import type { PatchFile, PnpmSettings } from "#/lib/types";
+import { readTypedYamlSync, writeTypedYamlSync } from "#/lib/utils";
 
 /**
  * Copy `pnpm-workspace.yaml` from the workspace root to the isolate directory,
@@ -39,7 +39,7 @@ export function writeIsolatePnpmWorkspace({
   let settings: PnpmSettings | undefined;
 
   try {
-    settings = readTypedYamlSync<PnpmSettings>(sourcePath);
+    settings = readTypedYamlSync(sourcePath) as PnpmSettings | undefined;
   } catch (error) {
     log.warn(
       `Could not read pnpm-workspace.yaml, falling back to verbatim copy: ${error instanceof Error ? error.message : String(error)}`,

package/src/lib/registry/collect-reachable-package-names.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import type { PackageManifest, PackagesRegistry } from "~/lib/types";
+import type { PackageManifest, PackagesRegistry } from "#/lib/types";
 import { collectReachablePackageNames } from "./collect-reachable-package-names";
 
 function entry(manifest: PackageManifest) {

package/src/lib/registry/create-packages-registry.ts

@@ -28,38 +28,41 @@ export async function createPackagesRegistry(
     workspaceRootDir,
   );
 
-  const registry: PackagesRegistry = (
-    await Promise.all(
-      allPackages.map(async (rootRelativeDir) => {
-        const absoluteDir = path.join(workspaceRootDir, rootRelativeDir);
-        const manifestPath = path.join(absoluteDir, "package.json");
+  const entries = await Promise.all(
+    allPackages.map(async (rootRelativeDir) => {
+      const absoluteDir = path.join(workspaceRootDir, rootRelativeDir);
+      const manifestPath = path.join(absoluteDir, "package.json");
 
-        if (!fs.existsSync(manifestPath)) {
-          log.warn(
-            `Ignoring directory ${rootRelativeDir} because it does not contain a package.json file`,
-          );
-          return;
-        } else {
-          log.debug(`Registering package ${rootRelativeDir}`);
+      if (!fs.existsSync(manifestPath)) {
+        log.warn(
+          `Ignoring directory ${rootRelativeDir} because it does not contain a package.json file`,
+        );
+        return null;
+      }
 
-          const manifest = await readTypedJson<PackageManifest>(
-            path.join(absoluteDir, "package.json"),
-          );
+      log.debug(`Registering package ${rootRelativeDir}`);
 
-          return {
-            manifest,
-            rootRelativeDir,
-            absoluteDir,
-          };
-        }
-      }),
-    )
-  ).reduce<PackagesRegistry>((acc, info) => {
-    if (info) {
-      acc[info.manifest.name] = info;
-    }
-    return acc;
-  }, {});
+      const manifest = (await readTypedJson(
+        path.join(absoluteDir, "package.json"),
+      )) as PackageManifest;
+
+      return {
+        manifest,
+        rootRelativeDir,
+        absoluteDir,
+      };
+    }),
+  );
+
+  const registry: PackagesRegistry = entries.reduce<PackagesRegistry>(
+    (acc, info) => {
+      if (info) {
+        acc[info.manifest.name] = info;
+      }
+      return acc;
+    },
+    {},
+  );
 
   return registry;
 }
@@ -73,9 +76,9 @@ function listWorkspacePackages(
   workspaceRootDir: string,
 ) {
   if (isRushWorkspace(workspaceRootDir)) {
-    const rushConfig = readTypedJsonSync<RushConfig>(
+    const rushConfig = readTypedJsonSync(
       path.join(workspaceRootDir, "rush.json"),
-    );
+    ) as RushConfig;
 
     return rushConfig.projects.map(({ projectFolder }) => projectFolder);
   } else {

package/src/lib/registry/helpers/find-packages-globs.ts

@@ -13,16 +13,16 @@ import {
  * monorepo. This configuration is dependent on the package manager used, and I
  * don't know if we're covering all cases yet...
  */
-export function findPackagesGlobs(workspaceRootDir: string) {
+export function findPackagesGlobs(workspaceRootDir: string): string[] {
   const log = useLogger();
 
   const packageManager = usePackageManager();
 
   switch (packageManager.name) {
     case "pnpm": {
-      const workspaceConfig = readTypedYamlSync<{ packages: string[] }>(
+      const workspaceConfig = readTypedYamlSync(
         path.join(workspaceRootDir, "pnpm-workspace.yaml"),
-      );
+      ) as { packages: string[] } | undefined;
 
       if (!workspaceConfig) {
         throw new Error(
@@ -48,9 +48,9 @@ export function findPackagesGlobs(workspaceRootDir: string) {
         "package.json",
       );
 
-      const { workspaces } = readTypedJsonSync<{ workspaces: string[] }>(
-        workspaceRootManifestPath,
-      );
+      const { workspaces } = readTypedJsonSync(workspaceRootManifestPath) as {
+        workspaces: string[];
+      };
 
       if (!workspaces) {
         throw new Error(
@@ -60,21 +60,25 @@ export function findPackagesGlobs(workspaceRootDir: string) {
 
       if (Array.isArray(workspaces)) {
         return workspaces;
-      } else {
-        /**
-         * For Yarn, workspaces could be defined as an object with { packages:
-         * [], nohoist: [] }. See
-         * https://classic.yarnpkg.com/blog/2018/02/15/nohoist/
-         */
-        const workspacesObject = workspaces as { packages?: string[] };
+      }
 
-        assert(
-          workspacesObject.packages,
-          "workspaces.packages must be an array",
-        );
+      /**
+       * For Yarn, workspaces could be defined as an object with { packages: [],
+       * nohoist: [] }. See
+       * https://classic.yarnpkg.com/blog/2018/02/15/nohoist/
+       */
+      const workspacesObject = workspaces as { packages?: string[] };
 
-        return workspacesObject.packages;
-      }
+      assert(
+        Array.isArray(workspacesObject.packages),
+        "workspaces.packages must be an array",
+      );
+
+      return workspacesObject.packages;
     }
+    default:
+      throw new Error(
+        `Unsupported package manager: ${packageManager.name as string}`,
+      );
   }
 }

package/src/lib/registry/list-internal-packages.test.ts

@@ -1,10 +1,10 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
-import type { PackageManifest, PackagesRegistry } from "~/lib/types";
+import type { PackageManifest, PackagesRegistry } from "#/lib/types";
 import { listInternalPackages } from "./list-internal-packages";
 
 const mockWarn = vi.fn();
 
-vi.mock("~/lib/logger", () => ({
+vi.mock("#/lib/logger", () => ({
   useLogger: () => ({
     debug: vi.fn(),
     info: vi.fn(),

package/src/lib/types.ts

@@ -6,10 +6,10 @@ export type { PnpmSettings } from "@pnpm/types";
  * Represents a patch file entry in the pnpm lockfile. Contains the path to the
  * patch file and its content hash.
  */
-export interface PatchFile {
+export type PatchFile = {
   path: string;
   hash: string;
-}
+};
 
 export type PackageManifest = PnpmPackageManifest & {
   packageManager?: string;

package/src/lib/utils/filter-patched-dependencies.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import type { PackageManifest } from "~/lib/types";
+import type { PackageManifest } from "#/lib/types";
 import { filterPatchedDependencies } from "./filter-patched-dependencies";
 
 describe("filterPatchedDependencies", () => {

package/src/lib/utils/filter-patched-dependencies.ts

@@ -1,5 +1,5 @@
-import { useLogger } from "~/lib/logger";
-import type { PackageManifest } from "~/lib/types";
+import { useLogger } from "#/lib/logger";
+import type { PackageManifest } from "#/lib/types";
 import { getPackageName } from "./get-package-name";
 
 /**

package/src/lib/utils/get-dirname.ts

@@ -1,4 +1,4 @@
-import { fileURLToPath } from "url";
+import { fileURLToPath } from "node:url";
 
 /**
  * Calling context should pass in import.meta.url and the function will return

package/src/lib/utils/index.ts

@@ -8,6 +8,6 @@ export * from "./is-present";
 export * from "./is-rush-workspace";
 export * from "./json";
 export * from "./log-paths";
-export * from "./pack";
+export * from "./reset-isolate-dir";
 export * from "./unpack";
 export * from "./yaml";

package/src/lib/utils/json.ts

@@ -3,32 +3,30 @@ import stripJsonComments from "strip-json-comments";
 import { getErrorMessage } from "./get-error-message";
 
 /** @todo Pass in zod schema and validate */
-export function readTypedJsonSync<T>(filePath: string) {
+export function readTypedJsonSync(filePath: string): unknown {
   try {
     const rawContent = fs.readFileSync(filePath, "utf-8");
-    const data = JSON.parse(
+    return JSON.parse(
       stripJsonComments(rawContent, { trailingCommas: true }),
-    ) as T;
-    return data;
-  } catch (err) {
+    ) as unknown;
+  } catch (error) {
     throw new Error(
-      `Failed to read JSON from ${filePath}: ${getErrorMessage(err)}`,
-      { cause: err },
+      `Failed to read JSON from ${filePath}: ${getErrorMessage(error)}`,
+      { cause: error },
     );
   }
 }
 
-export async function readTypedJson<T>(filePath: string) {
+export async function readTypedJson(filePath: string): Promise<unknown> {
   try {
     const rawContent = await fs.readFile(filePath, "utf-8");
-    const data = JSON.parse(
+    return JSON.parse(
       stripJsonComments(rawContent, { trailingCommas: true }),
-    ) as T;
-    return data;
-  } catch (err) {
+    ) as unknown;
+  } catch (error) {
     throw new Error(
-      `Failed to read JSON from ${filePath}: ${getErrorMessage(err)}`,
-      { cause: err },
+      `Failed to read JSON from ${filePath}: ${getErrorMessage(error)}`,
+      { cause: error },
     );
   }
 }

package/src/lib/utils/pack.ts

@@ -1,26 +1,31 @@
 import assert from "node:assert";
 import { exec } from "node:child_process";
-import fs from "node:fs";
 import path from "node:path";
 import { useLogger } from "../logger";
 import { shouldUsePnpmPack } from "../package-manager";
 import { getErrorMessage } from "./get-error-message";
+import { waitForCompleteFile } from "./wait-for-complete-file";
+
+/**
+ * How long to wait for the packed tarball to appear and stop growing on disk
+ * after `pnpm pack` / `npm pack` has exited.
+ */
+const PACK_FILE_READY_TIMEOUT_MS = 5000;
+const PACK_FILE_READY_POLL_MS = 50;
 
 export async function pack(srcDir: string, dstDir: string) {
   const log = useLogger();
 
   const execOptions = {
+    cwd: srcDir,
     maxBuffer: 10 * 1024 * 1024,
   };
 
-  const previousCwd = process.cwd();
-  process.chdir(srcDir);
-
   /**
    * PNPM pack seems to be a lot faster than NPM pack, so when PNPM is detected
    * we use that instead.
    */
-  const stdout = shouldUsePnpmPack()
+  const packStdout = shouldUsePnpmPack()
     ? await new Promise<string>((resolve, reject) => {
         exec(
           `pnpm pack --pack-destination "${dstDir}"`,
@@ -28,7 +33,8 @@ export async function pack(srcDir: string, dstDir: string) {
           (err, stdout) => {
             if (err) {
               log.error(getErrorMessage(err));
-              return reject(err);
+              reject(err);
+              return;
             }
 
             resolve(stdout);
@@ -41,7 +47,8 @@ export async function pack(srcDir: string, dstDir: string) {
           execOptions,
           (err, stdout) => {
             if (err) {
-              return reject(err);
+              reject(err);
+              return;
             }
 
             resolve(stdout);
@@ -49,9 +56,12 @@ export async function pack(srcDir: string, dstDir: string) {
         );
       });
 
-  const lastLine = stdout.trim().split("\n").at(-1);
+  const lastLine = packStdout.trim().split("\n").at(-1);
 
-  assert(lastLine, `Failed to parse last line from stdout: ${stdout.trim()}`);
+  assert(
+    lastLine,
+    `Failed to parse last line from stdout: ${packStdout.trim()}`,
+  );
 
   const fileName = path.basename(lastLine);
 
@@ -59,20 +69,20 @@ export async function pack(srcDir: string, dstDir: string) {
 
   const filePath = path.join(dstDir, fileName);
 
-  if (!fs.existsSync(filePath)) {
-    log.error(
-      `The response from pack could not be resolved to an existing file: ${filePath}`,
-    );
-  } else {
-    log.debug(`Packed (temp)/${fileName}`);
-  }
-
-  process.chdir(previousCwd);
-
   /**
-   * Return the path anyway even if it doesn't validate. A later stage will wait
-   * for the file to occur still. Not sure if this makes sense. Maybe we should
-   * stop at the validation error...
+   * `pnpm pack` (and occasionally `npm pack`) can return before the tarball is
+   * fully visible/flushed to disk. A naive `existsSync` check is not enough:
+   * the directory entry can appear before the file's data has been written,
+   * which causes downstream consumers (gunzip + tar) to fail with
+   * "unexpected end of file". Wait until the file exists and its size has
+   * stopped changing across two consecutive polls before returning.
    */
+  await waitForCompleteFile(filePath, {
+    timeoutMs: PACK_FILE_READY_TIMEOUT_MS,
+    pollMs: PACK_FILE_READY_POLL_MS,
+  });
+
+  log.debug(`Packed (temp)/${fileName}`);
+
   return filePath;
 }