feat(yarn): support berry portal and exec protocols by jdx · Pull Request #729 · jdx/aube

jdx · 2026-05-15T19:32:39Z

Summary

add LocalSource::Portal and LocalSource::Exec so Yarn Berry portal: and exec: lockfile entries are parsed instead of skipped
preserve both protocols when writing Berry lockfiles, with portal: emitted as linkType: soft and exec: emitted as a generated hard-link package
materialize portal: targets as local packages so graph-visible dependencies are linked, and run exec: generators into a temp build directory before importing the generated package
resolve exec: generators during fresh resolution so generated versions and dependencies are locked, while normalizing root/transitive script paths to a single dep path
keep resolve-time and fetch-time exec environments aligned, block exec generator execution under --ignore-scripts, and reject exec: scripts that resolve outside the project root
add parser/writer tests, resolver regression coverage, and an install fixture covering a portal package that depends on an exec-generated package
stabilize the Windows job-object regression test by waiting for a parseable grandchild PID before asserting process liveness

Notes

Yarn documents portal: as a local package whose dependencies are followed, unlike link:. It documents exec: as a generator script that populates execEnv.buildDir; this PR implements that shape for both fresh resolution and lockfile-backed installs.

exec: generators require Node.js on PATH and are treated as script execution. Fresh resolution fails before running them when --ignore-scripts is set, and both resolve-time and fetch-time execution canonicalize the generator path and require it to stay inside the project root.

Validation

cargo test -p aube-lockfile test_parse_berry_portal_and_exec_protocols
cargo test -p aube-lockfile test_write_berry_roundtrips_portal_and_exec_protocols
cargo test -p aube-resolver --no-fail-fast
cargo test -p aube-scripts --lib
cargo build
mise run test:bats test/import.bats
cargo fmt --check
cargo clippy --all-targets -- -D warnings

socket-security · 2026-05-15T19:33:46Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/exec-pkg@2.0.0
	npm/portal-pkg@1.0.0

View full report

greptile-apps · 2026-05-15T19:37:06Z

Greptile Summary

This PR adds first-class support for Yarn Berry's portal: and exec: lockfile protocols, enabling aube to parse, resolve, fetch, and write both protocol types instead of skipping them with a warning.

portal: packages are parsed as LocalSource::Portal, materialized into the store like directory packages (so transitive deps are graph-visible), emitted with linkType: soft in Berry lockfiles, and bundled in deploy artifacts.
exec: packages are parsed as LocalSource::Exec, validated against the project root via canonicalize-based path-boundary check, run via a Node.js wrapper at both resolve time (to lock version/deps) and fetch time (to populate the store), blocked under --ignore-scripts, and excluded from pnpm lockfile output (no pnpm analogue). The exec fingerprint now includes script content so store cache is invalidated on script edits.

Confidence Score: 5/5

The change is well-bounded — new protocol variants are wired consistently across parse, rebase, resolve, fetch, delta, linker, deploy, and lockfile-write paths. The path-boundary check for exec scripts prevents execution outside the project root.

Both variants are handled in every consumer that previously matched on LocalSource; tests cover round-trip, fresh-resolve, ignore-scripts, path-boundary, and fingerprint-change scenarios. No silent data-loss or correctness gaps were found in the changed paths.

crates/aube-resolver/src/lib.rs (YARN_EXEC_WRAPPER CommonJS limitation) and crates/aube-resolver/src/local_source.rs (double generator execution during fresh resolve)

Important Files Changed

Filename	Overview
crates/aube-lockfile/src/source.rs	Adds Portal and Exec variants to LocalSource enum; both are correctly handled in path(), protocol_str(), and parse()
crates/aube-lockfile/src/yarn/berry.rs	Replaces the portal/exec skip-with-warning path with proper parsing; correctly emits linkType: soft for portals and hard for exec
crates/aube-resolver/src/local_source.rs	Adds resolve_exec_script_path (with canonicalize path-boundary check), resolve_exec_manifest, Portal/Exec rebase and is_non_registry_specifier support; exec generator is run twice during fresh resolution
crates/aube-resolver/src/resolve.rs	Correctly integrates exec manifest resolution (with ignore_scripts guard), excludes Exec from parent_source_root anchor, and extends dep enqueueing to portal/exec packages
crates/aube/src/commands/install/fetch.rs	Materializes portal packages like directories; runs exec generator with path-boundary validation, ignore_scripts guard, and proper temp-dir lifecycle
crates/aube/src/commands/install/delta.rs	Adds Portal and Exec fingerprint cases; Exec fingerprint now includes script content so cache is invalidated on script edits
crates/aube-resolver/src/lib.rs	Exposes YARN_EXEC_WRAPPER constant and resolve_exec_script_path; wrapper only supports CommonJS exec scripts (ESM will fail with ERR_REQUIRE_ESM)
crates/aube/src/commands/deploy.rs	Correctly extends seed, plan_injections, and rewrite_local_refs to handle Portal (bundled) and Exec (standalone) sources
crates/aube-lockfile/src/pnpm/write.rs	Omits exec packages from pnpm lockfile (no pnpm analogue), writes portal packages as type:directory resolution
fixtures/import-yarn-portal-exec/packages/portal/package.json	Portal package correctly references exec script as ../../scripts/generate-exec.js relative to its directory

_{Reviews (12): Last reviewed commit: "fix(yarn): bound exec generator paths" | Re-trigger Greptile}

cursor

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2fb797b. Configure here.}

cursor Bot reviewed May 15, 2026

View reviewed changes

Comment thread crates/aube-resolver/src/local_source.rs

greptile-apps Bot reviewed May 15, 2026

View reviewed changes

Comment thread crates/aube-lockfile/src/source.rs

Comment thread crates/aube/src/commands/install/delta.rs

Comment thread crates/aube-lockfile/src/yarn/tests.rs

jdx force-pushed the codex/add-yarn-portal-exec-support branch from b582cd0 to 862ff35 Compare May 15, 2026 19:59

cursor Bot reviewed May 15, 2026

View reviewed changes

Comment thread crates/aube/src/commands/deploy.rs Outdated

jdx added 2 commits May 17, 2026 15:03

feat(yarn): support berry portal and exec protocols

1207b05

fix(yarn): handle exec protocol feedback

e35c378

jdx force-pushed the codex/add-yarn-portal-exec-support branch from 862ff35 to e35c378 Compare May 17, 2026 15:04