pnpm-dedup 2.2.1 → 2.2.2

package/src/applyClusterFixes.ts

@@ -6,10 +6,13 @@ import {
   createPackageFilter,
   describeSkippedClusterFix,
   diffDuplicates,
+  heldOverrides,
+  outstandingOverrides,
   partitionUnconditionalOverrides,
   planClusterApply,
   renderApplyPlan,
   restoreFiles,
+  reuseKeys,
   selectClusterFixes,
   shouldColorize,
 } from "pm-dedup-core";
@@ -18,12 +21,17 @@ import type {
   ClusterFix,
   DuplicateSnapshot,
   FileSnapshot,
+  OverrideTargetState,
   PackageFilterOptions,
   PlannedManifestEdit,
   PlannedOverride,
   SelectedClusterFixes,
+  VersionsSnapshot,
 } from "pm-dedup-core";
 import { buildPnpmPackagesMap } from "./helpers/buildPnpmPackagesMap.ts";
+import { collectDependentRanges } from "./helpers/collectDependentRanges.ts";
+import type { DependentRangesMap } from "./helpers/collectDependentRanges.ts";
+import { describeUnheldOverride } from "./helpers/describeUnheldOverride.ts";
 import { readDuplicateSnapshot } from "./helpers/duplicateSnapshot.ts";
 import { parsePnpmLockPackages } from "./helpers/parsePnpmLockPackages.ts";
 import {
@@ -35,6 +43,7 @@ import { addOverrides, overrideKey } from "./helpers/pnpmWorkspaceYaml.ts";
 import { lockPathOf } from "./helpers/projectDir.ts";
 import { createManifestReader } from "./helpers/readInstalledManifest.ts";
 import { runPnpm } from "./helpers/runPnpm.ts";
+import { readVersionsSnapshot } from "./helpers/versionsSnapshot.ts";
 import { identifyClusterFixes } from "./identifyClusterFixes.ts";
 import { readPnpmLock } from "./readPnpmLock.ts";
 
@@ -43,7 +52,6 @@ const issuesUrl = "https://github.com/christophehurpeau/pm-tools/issues";
 export type ClusterApplyStatus =
   | "applied"
   | "dry-run"
-  | "kept-overrides"
   | "not-supported"
   | "nothing-to-do"
   | "reverted";
@@ -52,7 +60,7 @@ export interface ClusterApplyOutcome {
   status: ClusterApplyStatus;
   before: DuplicateSnapshot;
   after: DuplicateSnapshot;
-  // overrides the duplicates came back without: reported, never left behind
+  // overrides the result did not hold without: reported, never left behind
   stickyOverrides: PlannedOverride[];
   // how many edits the plan holds, so `--check` gates without re-planning
   plannedChangeCount: number;
@@ -66,6 +74,11 @@ export interface ApplyClusterFixesOptions {
   resolve?: () => number | null;
   readFixes?: (projectDir: string) => ClusterFix[];
   readDuplicates?: (lockPath: string) => DuplicateSnapshot;
+  readVersions?: (lockPath: string) => VersionsSnapshot;
+  readDependentRanges?: (
+    projectDir: string,
+    packageNames: Set<string>,
+  ) => DependentRangesMap;
   pnpmVersion?: () => string | null;
   // false writes plain overrides instead, which pnpm applies to every requester
   // whatever range it declares
@@ -99,36 +112,29 @@ const describeOverride = (
 ): string =>
   `"${overrideKey(override.packageName, convergence)}": "${override.version}"`;
 
-/**
- * Why the overrides below them had to stay. Used verbatim as the comment left in
- * `pnpm-workspace.yaml` and as the console explanation, so the file and the run
- * say the same thing. The packages are the entries that follow, so they are not
- * repeated here.
- */
-const stickyOverrideReason: string[] = [
-  "Added by pnpm-dedup.",
-  "Removing these makes `pnpm dedupe` resolve them back to a duplicate, so they",
-  "are what holds the deduplicated result. Keeping them is a workaround: no fix",
-  "was found that survives on its own. Please report this cluster so it can be",
-  `handled without a standing override: ${issuesUrl}`,
-];
-
-interface ApplyState {
-  duplicates: DuplicateSnapshot;
-  // one key per open range still resolving away from the version the workspace
-  // anchors its family at
-  reuses: Set<string>;
-}
-
-const reuseKeys = (fixes: ClusterFix[]): Set<string> =>
-  new Set(
-    fixes.flatMap((fix) =>
-      fix.reuseFixes.map(
-        (reuse) => `${reuse.requesterName}>${reuse.packageName}@${reuse.to}`,
-      ),
-    ),
+const defaultReadDependentRanges = (
+  projectDir: string,
+  packageNames: Set<string>,
+): DependentRangesMap =>
+  collectDependentRanges(
+    readPnpmLock(lockPathOf(projectDir)),
+    packageNames,
+    createManifestReader(projectDir),
   );
 
+// Each round only drops overrides, so this bounds a run that keeps losing one to
+// a companion it held alongside.
+const maxOverrideRounds = 3;
+
+type ApplyState = OverrideTargetState;
+
+interface DroppedOverride {
+  override: PlannedOverride;
+  // whether it held while the overrides were there, and only came apart once
+  // pnpm resolved without them
+  heldWithOverrides: boolean;
+}
+
 export const applyClusterFixes = ({
   projectDir,
   dryRun = false,
@@ -141,6 +147,8 @@ export const applyClusterFixes = ({
   resolve = () => runPnpm(["dedupe"], { cwd: projectDir }).status,
   readFixes = defaultReadFixes,
   readDuplicates = readDuplicateSnapshot,
+  readVersions = readVersionsSnapshot,
+  readDependentRanges = defaultReadDependentRanges,
   pnpmVersion = () => readPnpmVersion(),
   convergenceOverrides = true,
   filter,
@@ -167,7 +175,10 @@ export const applyClusterFixes = ({
 
   const { selected: fixes, skipped: filteredOut } =
     readSelectedFixes(projectDir);
-  const plan = planClusterApply(fixes);
+  // pnpm resolves an open range to the highest copy still in the tree, so a
+  // reuse of the pinned version comes apart as soon as its override is removed.
+  // The report still names those ranges; the plan does not chase them.
+  const plan = planClusterApply(fixes, { reuse: false });
 
   const skipped = [
     ...filteredOut.map(describeSkippedClusterFix),
@@ -309,6 +320,7 @@ export const applyClusterFixes = ({
   // gone from its output once the edge points at the anchored version.
   const readState = (): ApplyState => ({
     duplicates: readDuplicates(lockPath),
+    versions: readVersions(lockPath),
     reuses: reuseKeys(readSelectedFixes(projectDir).selected),
   });
 
@@ -346,121 +358,162 @@ export const applyClusterFixes = ({
   )!;
 
   const remaining = readState();
-  // An override is still worth writing while its package is duplicated, or
-  // while the edge it repoints is still resolving elsewhere.
-  const outstanding = plannedOverrides.filter(
-    (override) =>
-      [...remaining.duplicates].some((resolution) =>
-        resolution.startsWith(`${override.packageName}@`),
-      ) ||
-      [...remaining.reuses].some((key) =>
-        key.endsWith(`>${override.packageName}@${override.version}`),
-      ),
-  );
-
-  if (outstanding.length === 0) {
-    return {
-      status: "applied",
-      before,
-      after: remaining.duplicates,
-      stickyOverrides: [],
-      plannedChangeCount: changeCount,
-    };
-  }
+  const outstanding = outstandingOverrides(plannedOverrides, remaining);
 
-  log(
-    `Adding ${convergenceOverrides ? "convergence" : "plain"} overrides to pnpm-workspace.yaml:`,
-  );
-  for (const override of outstanding) {
-    log(
-      `  ${describeOverride(override, convergenceOverrides)} (${override.reason})`,
-    );
-  }
-  writeFileSync(
-    workspaceYamlPath,
-    addOverrides(
-      workspaceYamlBefore.content,
-      new Map(
-        outstanding.map((override) => [override.packageName, override.version]),
-      ),
-      { convergence: convergenceOverrides },
-    ),
-  );
+  const keptOutcome = (
+    after: DuplicateSnapshot,
+    stickyOverrides: PlannedOverride[],
+  ): ClusterApplyOutcome => ({
+    status: "applied",
+    before,
+    after,
+    stickyOverrides,
+    plannedChangeCount: changeCount,
+  });
 
-  const withOverrides = resolveAndCheck("the overrides");
-  if (withOverrides === null) {
-    revertTo(withoutOverridesSnapshot);
-    return unchanged("reverted", changeCount);
+  if (outstanding.length === 0) {
+    return keptOutcome(remaining.duplicates, []);
   }
 
-  // Overrides are scaffolding first: if pnpm holds the result without them they
-  // are removed, and if it does not they go back with the reason recorded.
-  log("Removing the overrides and re-resolving to check the result holds:");
-  restoreFiles([workspaceYamlBefore]);
-
-  if (resolve() !== 0) {
-    log("  `pnpm dedupe` failed without the overrides — reverting");
+  // The range edits already held on their own, so dropping the overrides keeps
+  // them: only a run that made none of those has nothing left to show.
+  const withoutOverrides = (
+    stickyOverrides: PlannedOverride[],
+  ): ClusterApplyOutcome => {
     revertTo(withoutOverridesSnapshot);
-    return unchanged("reverted", changeCount);
-  }
-
-  const after = readState();
-  const returnedDuplicates = diffDuplicates(
-    withOverrides.duplicates,
-    after.duplicates,
-  ).added;
-  const returnedReuses = [...after.reuses].filter(
-    (key) => !withOverrides.reuses.has(key),
-  );
+    return plan.manifestEdits.length > 0
+      ? keptOutcome(readDuplicates(lockPath), stickyOverrides)
+      : { ...unchanged("reverted", changeCount), stickyOverrides };
+  };
 
-  if (returnedDuplicates.length > 0 || returnedReuses.length > 0) {
+  const heldIn = (
+    overrides: PlannedOverride[],
+    end: ApplyState,
+  ): PlannedOverride[] => heldOverrides(overrides, { start: remaining, end });
+
+  // Overrides are scaffolding: they are written, pnpm resolves with them, and
+  // what counts is what is still there once they are removed again.
+  const overrideRound = (
+    overrides: PlannedOverride[],
+  ): {
+    heldWith: PlannedOverride[];
+    heldAfter: PlannedOverride[];
+    after: ApplyState;
+  } | null => {
+    log(
+      `Adding ${convergenceOverrides ? "convergence" : "plain"} overrides to pnpm-workspace.yaml:`,
+    );
+    for (const override of overrides) {
+      log(
+        `  ${describeOverride(override, convergenceOverrides)} (${override.reason})`,
+      );
+    }
     writeFileSync(
       workspaceYamlPath,
       addOverrides(
         workspaceYamlBefore.content,
         new Map(
-          outstanding.map((override) => [
-            override.packageName,
-            override.version,
-          ]),
+          overrides.map((override) => [override.packageName, override.version]),
         ),
-        {
-          convergence: convergenceOverrides,
-          comment: stickyOverrideReason.join("\n"),
-        },
+        { convergence: convergenceOverrides },
       ),
     );
 
-    if (resolve() !== 0) {
-      log("  `pnpm dedupe` failed with the overrides back — reverting");
-      revertTo(withoutOverridesSnapshot);
-      return unchanged("reverted", changeCount);
-    }
+    const withOverrides = resolveAndCheck("the overrides");
+    if (withOverrides === null) return null;
+    const heldWith = heldIn(overrides, withOverrides);
+
+    log("Removing the overrides and re-resolving to check the result holds:");
+    restoreFiles([workspaceYamlBefore]);
+    const after = resolveAndCheck("removing the overrides");
+    if (after === null) return null;
+
+    return { heldWith, heldAfter: heldIn(overrides, after), after };
+  };
+
+  // A member nothing duplicates only moves for its family's sake, so the
+  // family's duplicated members already say what did not merge.
+  const reportDropped = (dropped: DroppedOverride[]): void => {
+    const reported = dropped.filter(({ override }) =>
+      [...remaining.duplicates].some((resolution) =>
+        resolution.startsWith(`${override.packageName}@`),
+      ),
+    );
+    if (reported.length === 0) return;
+
+    const ranges = readDependentRanges(
+      projectDir,
+      new Set(reported.map(({ override }) => override.packageName)),
+    );
+    const logGroup = (title: string, entries: DroppedOverride[]): void => {
+      if (entries.length === 0) return;
+      log(title);
+      for (const { override } of entries) {
+        log(`  ${override.packageName} onto ${override.version}:`);
+        for (const line of describeUnheldOverride(
+          override,
+          ranges.get(override.packageName) ?? [],
+        )) {
+          log(`    ${line}`);
+        }
+      }
+    };
 
+    logGroup(
+      "Not merged even with an override:",
+      reported.filter((entry) => !entry.heldWithOverrides),
+    );
+    logGroup(
+      "pnpm resolves these back without an override, so they are not merged:",
+      reported.filter((entry) => entry.heldWithOverrides),
+    );
     log(
-      `  Kept in ${workspaceYamlPath}, with the same explanation as a comment:`,
+      `No override is left behind. If one of these should merge, please report it at ${issuesUrl}`,
     );
-    for (const override of outstanding) {
-      log(`    ${describeOverride(override, convergenceOverrides)}`);
+  };
+
+  const dropped: DroppedOverride[] = [];
+  let candidates = outstanding;
+  for (let round = 1; round <= maxOverrideRounds; round++) {
+    if (round > 1) {
+      log("Retrying with only the overrides that held:");
+      restoreFiles(withoutOverridesSnapshot);
     }
-    for (const line of stickyOverrideReason) {
-      log(`  ${line}`);
+
+    const result = overrideRound(candidates);
+    if (result === null) return withoutOverrides([]);
+
+    const { heldWith, heldAfter, after } = result;
+    for (const override of candidates) {
+      if (!heldAfter.includes(override)) {
+        dropped.push({
+          override,
+          heldWithOverrides: heldWith.includes(override),
+        });
+      }
     }
 
-    return {
-      status: "kept-overrides",
-      before,
-      after: readDuplicates(lockPath),
-      stickyOverrides: outstanding,
-      plannedChangeCount: changeCount,
-    };
+    if (heldAfter.length === candidates.length) {
+      reportDropped(dropped);
+      return keptOutcome(
+        after.duplicates,
+        dropped.map(({ override }) => override),
+      );
+    }
+    candidates = heldAfter;
+    if (candidates.length === 0) break;
   }
 
-  return {
-    status: "applied",
-    before,
-    after: after.duplicates,
-    stickyOverrides: [],
-    plannedChangeCount: changeCount,
-  };
+  log(
+    candidates.length === 0
+      ? "  No override holds on its own — reverting them"
+      : `  Overrides still came apart after ${maxOverrideRounds} rounds — reverting them`,
+  );
+  // what is left only held alongside overrides the last round dropped
+  dropped.push(
+    ...candidates.map((override) => ({ override, heldWithOverrides: true })),
+  );
+  const outcome = withoutOverrides(dropped.map(({ override }) => override));
+  reportDropped(dropped);
+  return outcome;
 };

package/src/bin/pnpm-why-duplicate.test.ts

@@ -1,7 +1,8 @@
-import { afterEach, describe, expect, it } from "bun:test";
+import { ok, strictEqual } from "node:assert/strict";
 import { spawnSync } from "node:child_process";
 import { cpSync, mkdirSync, realpathSync } from "node:fs";
 import { join } from "node:path";
+import { afterEach, describe, it } from "node:test";
 import { fileURLToPath } from "node:url";
 import { createTempProjects } from "../helpers/tempProjects.ts";
 
@@ -58,11 +59,11 @@ describe("pnpm-why-duplicate", () => {
       const fromRoot = runBin("pnpm-why-duplicate", dir, ["--details"]);
       const fromNested = runBin("pnpm-why-duplicate", nested, ["--details"]);
 
-      expect(fromNested.status).toBe(0);
-      expect(fromNested.stdout).toBe(fromRoot.stdout);
-      expect(fromNested.stdout).toContain("printable-shell-command");
-      expect(fromNested.stderr.trim()).toBe(lockNotice(dir));
-      expect(fromRoot.stderr).toBe("");
+      strictEqual(fromNested.status, 0);
+      strictEqual(fromNested.stdout, fromRoot.stdout);
+      ok(fromNested.stdout.includes("printable-shell-command"));
+      strictEqual(fromNested.stderr.trim(), lockNotice(dir));
+      strictEqual(fromRoot.stderr, "");
     });
 
     it("names the lockfile it could not find and exits 1", () => {
@@ -70,10 +71,32 @@ describe("pnpm-why-duplicate", () => {
 
       const result = runBin("pnpm-why-duplicate", dir, []);
 
-      expect(result.status).toBe(1);
-      expect(result.stderr.trim()).toBe(
+      strictEqual(result.status, 1);
+      strictEqual(
+        result.stderr.trim(),
         `No pnpm-lock.yaml found in ${realpathSync(dir)} or any parent directory`,
       );
     });
   });
+
+  it("reports on a lockfile that also resolves the package manager", () => {
+    const result = runBin(
+      "pnpm-why-duplicate",
+      project("package-manager-document"),
+      ["--details"],
+    );
+
+    strictEqual(result.stderr, "");
+    strictEqual(result.status, 0);
+    strictEqual(
+      result.stdout,
+      runBin(
+        "pnpm-why-duplicate",
+        project("duplicated-printable-shell-command"),
+        ["--details"],
+      ).stdout,
+    );
+    ok(result.stdout.includes("printable-shell-command"));
+    ok(!result.stdout.includes("@pnpm/exe"));
+  });
 });

package/src/dedupe.ts

@@ -1,3 +1,5 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
 import {
   countDuplicatedPackages,
   createPackageFilter,
@@ -32,6 +34,23 @@ const residualsMessage = "`pnpm dedupe` would also change the lockfile.";
 const filteredResidualsMessage =
   "`pnpm dedupe` was not run: it ignores the package filter. Run `pnpm dedupe` yourself, or this command without a filter, to finish the rest.";
 
+// The comment pnpm-dedup 2.2 wrote above the overrides it kept. Those still
+// apply on every resolution, so a run cannot tell what holds without them.
+const leftoverOverridesMarker = "# Added by pnpm-dedup.";
+
+const warnOnLeftoverOverrides = (projectDir: string): void => {
+  const workspaceYamlPath = join(projectDir, "pnpm-workspace.yaml");
+  if (
+    !existsSync(workspaceYamlPath) ||
+    !readFileSync(workspaceYamlPath, "utf8").includes(leftoverOverridesMarker)
+  ) {
+    return;
+  }
+  console.log(
+    `pnpm-workspace.yaml still has overrides an earlier pnpm-dedup kept (under "${leftoverOverridesMarker.slice(2)}"). This version never keeps any: remove them and run again to see what holds on its own.`,
+  );
+};
+
 /**
  * `pnpm dedupe` only merges what it can resolve to a single version on its own:
  * it never widens a workspace range, and it never repoints an edge that resolved
@@ -79,6 +98,8 @@ export function dedupe({
     return undefined;
   })();
 
+  warnOnLeftoverOverrides(projectDir);
+
   const outcome = applyClusterFixes({
     projectDir,
     dryRun,
@@ -87,12 +108,6 @@ export function dedupe({
     packageManagerResiduals: residuals,
   });
 
-  if (outcome.status === "kept-overrides") {
-    console.log(
-      `${outcome.stickyOverrides.length} override(s) left in pnpm-workspace.yaml — see the comment above them`,
-    );
-  }
-
   if (mode === "check") {
     process.exitCode =
       outcome.plannedChangeCount > 0 || (probe !== null && probe.status !== 0)
@@ -106,7 +121,7 @@ export function dedupe({
     // Applying an override needs a real resolution, and `pnpm dedupe` is the
     // only one that performs it — so a filtered run that changed something has
     // already merged whatever else pnpm could reach on its own.
-    if (outcome.status === "applied" || outcome.status === "kept-overrides") {
+    if (outcome.status === "applied") {
       console.log(
         "`pnpm dedupe` ran to apply the fixes above and merged what it could on its own: the filter bounds the edits made here, not pnpm's resolution.",
       );