feat(plugin): add registry name handling and release age exclusion for pnpm workspace

packages/host/plugin-inventory/tests/install.spec.ts

@@ -1,11 +1,13 @@
-import { chmodSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, expect, it } from 'vitest'
+import { load } from 'js-yaml'
 import { readProfileManifest } from '@deepseek-ai/dsh-app-boot'
 import {
   composeOfflineBundle, INSTALL_REGISTRIES, parseBlockedBuilds, registryPackageName,
   resolvePnpm, resolvePnpmCommand, runPnpmInstall, writeAllowBuilds,
+  writeReleaseAgeExclude,
   runPnpmInstallWithRegistries, runPnpmRemove, uninstallBundle,
 } from '../src/install.ts'
 
@@ -67,24 +69,6 @@ function makeBlockedBuildPnpm(dir: string): string {
   return file
 }
 
-/**
- * A self-executable fake pnpm (shebang + executable bit) that records its argv
- * and exits 0 — simulates a `pnpm` command invoked directly off PATH, without a
- * `node` prefix (as the PATH-pnpm fallback does).
- */
-function makeExecutablePnpm(dir: string): string {
-  const file = join(dir, 'pnpm-path')
-  writeFileSync(file, [
-    '#!/usr/bin/env node',
-    "const fs = require('fs')",
-    'const args = process.argv.slice(2)',
-    'fs.writeFileSync(process.env.RECORD, JSON.stringify(args))',
-    'process.exit(0)',
-  ].join('\n'))
-  chmodSync(file, 0o755)
-  return file
-}
-
 /**
  * A fake pnpm that, for `remove <name>`, drops the named dependency from the
  * profile's package.json (as pnpm does) and exits 0.
@@ -171,7 +155,7 @@ describe('runPnpmInstall', () => {
     }
   })
 
-  it('passes minimum-release-age-exclude for a registry name', () => {
+  it('never passes a release-age CLI flag (the exemption is a workspace setting, not a flag)', () => {
     const dir = makeProfile()
     const record = join(dir, 'record.json')
     const pnpm = makeRecordingPnpm(dir)
@@ -181,32 +165,28 @@ describe('runPnpmInstall', () => {
       runPnpmInstall({
         binName: 'dsh', profileDir: dir, installAnchor: join(dir, 'package.json'),
         nodeBin: process.execPath, pnpmCjs: pnpm, spec: 'x',
-        before: readProfileManifest('dsh', dir), minimumReleaseAgeExclude: 'x',
+        before: readProfileManifest('dsh', dir),
       })
       const args = JSON.parse(readFileSync(record, 'utf8')) as string[]
-      expect(args).toContain('--minimum-release-age-exclude=x')
+      expect(args).toEqual(['add', 'x'])
+      expect(args.some(arg => arg.includes('minimum-release-age'))).toBe(false)
     } finally {
       delete process.env.RECORD
       delete process.env.EXIT
     }
   })
 
-  it('omits minimum-release-age-exclude for a PATH-pnpm fallback (may be an older pnpm)', () => {
+  it('writes the minimum-release-age exemption into pnpm-workspace.yaml, preserving existing settings', () => {
     const dir = makeProfile()
-    const record = join(dir, 'record.json')
-    const pnpm = makeExecutablePnpm(dir)
-    process.env.RECORD = record
-    try {
-      runPnpmInstall({
-        binName: 'dsh', profileDir: dir, installAnchor: join(dir, 'package.json'),
-        nodeBin: undefined, pnpmCjs: pnpm, spec: 'x',
-        before: readProfileManifest('dsh', dir), minimumReleaseAgeExclude: 'x',
-      })
-      const args = JSON.parse(readFileSync(record, 'utf8')) as string[]
-      expect(args).toEqual(['add', 'x'])
-    } finally {
-      delete process.env.RECORD
-    }
+    const workspacePath = join(dir, 'pnpm-workspace.yaml')
+    writeFileSync(workspacePath, 'autoInstallPeers: false\nallowBuilds:\n  node-pty: true\n')
+    writeReleaseAgeExclude(dir, ['dsh-theme-plugin'])
+    writeReleaseAgeExclude(dir, ['@scope/pkg'])
+    const doc = JSON.parse(JSON.stringify(load(readFileSync(workspacePath, 'utf8')))) as Record<string, unknown>
+    expect(doc.minimumReleaseAgeExclude).toEqual(['dsh-theme-plugin', '@scope/pkg'])
+    // Existing settings survive.
+    expect((doc.allowBuilds as Record<string, unknown>).node_pty ?? (doc.allowBuilds as Record<string, unknown>)['node-pty']).toBe(true)
+    expect(doc.autoInstallPeers).toBe(false)
   })
 
   it('returns pendingBuilds when pnpm blocks build scripts', () => {