Summary

Ports injectWorkspacePackages to pacquet end-to-end — config layer, resolver (global + per-dep), lockfile, and freshness gates — closing one of the eight settings tracked at #12009.

What the feature does

When set globally, workspace-package resolutions materialize as file: (hard-linked copies into the virtual store) instead of link: symlinks back to the source. Per-dependency dependenciesMeta[<name>].injected = true opts a single dep into the same behavior even when the global flag is off.

Changes

Config layer (commit b3a6895):

• Adds inject_workspace_packages: bool to Config (default false, matching pnpm's 'inject-workspace-packages': false).
• Adds the field to WorkspaceSettings so it parses from pnpm-workspace.yaml (camelCase).
• Threads config.inject_workspace_packages into ResolveOptions at the install entry point.
• Joins it to the workspace-state freshness comparison: current_settings writes the value, settings_match compares it, a flip between runs invalidates the optimistic-repeat-install cache.

End-to-end pipeline (commit 44e2ea9):

• LockfileSettings.inject_workspace_packages round-trips through the v9 lockfile. false omits the key on save, matching pnpm's lockfileFormatConverters.ts:70-72.
• dependencies_graph_to_lockfile populates the new field from Config.inject_workspace_packages.
• check_lockfile_settings adds a Boolean-normalized drift gate for settings.injectWorkspacePackages, mirroring upstream's getOutdatedLockfileSetting.ts:80-82.
• build_pkg_id_with_patch_hash now prefixes file:/git:/tarball: resolutions with name@ when the resolver didn't set name_ver, reading the name from the manifest — matching pnpm at resolveDependencies.ts:1502-1507. Without this, file: dep paths end up unprefixed and PkgNameVerPeer's @-split parser fails on the @ inside the peer suffix. link: ids are deliberately exempted so the downstream is_link short-circuit still triggers.

Cross-platform fix (commit 38a1db9):

• PkgNameVerPeer::to_virtual_store_name previously escaped only /, leaving : in file:-resolution slot names. NTFS / FAT reject these with ERROR_INVALID_NAME (123), but APFS / ext4 accept them, so the bug only surfaced once a workspace-injected dep hit the Windows CI of this PR. The escape now covers the full Windows-invalid charset [\\/:*?"<>|#], matching upstream's depPathToFilename regex.

Per-dep dependenciesMeta thread (commit 7cc0f98):

• importer_injected_dependency_names(manifest) reads dependenciesMeta from the importer manifest and returns the names whose injected flag is true.
• The wanted-spec tuple in extend_tree / resolve_catalog_specifiers widens from (alias, range, optional) to (alias, range, optional, injected). extend_tree lifts the spec's injected onto WantedDependency::injected as Some(true) / None, matching pnpm's injected: opts.dependenciesMeta[alias]?.injected shape so absent meta yields None (not Some(false)).
• WantedKey cache key gains a fourth slot for injected — the workspace branch of the npm resolver emits a file: resolution when injected and a link: one otherwise, so two importers asking for the same workspace dep with different per-dep flags must take different cache buckets.
• Importer-only scope: the child-spec walker keeps its 3-tuple shape; no resolved package's own dependenciesMeta is inherited. Hoisted-required / hoisted-optional peer arms default injected to false since they construct fresh wanteds without dep meta.

Refs #12009.

Test plan

• parses_inject_workspace_packages_true_from_yaml — yaml injectWorkspacePackages: true applies to Config.
• parses_inject_workspace_packages_false_from_yaml — explicit false overrides a pre-set config value.
• inject_workspace_packages_defaults_off_when_absent — missing yaml key leaves Config::new()'s false default.
• returns_skipped_when_inject_workspace_packages_drifts — workspace-state cache invalidates on flip.
• check_settings_passes_when_inject_workspace_packages_both_false — wire-format false omission round-trips correctly.
• check_settings_passes_when_inject_workspace_packages_both_true — explicit true round-trips.
• check_settings_returns_drift_when_config_enables_inject_workspace_packages — flipping on between installs surfaces drift.
• check_settings_returns_drift_when_config_disables_inject_workspace_packages — flipping off surfaces drift.
• inject_workspace_packages_writes_file_resolutions_and_lockfile_setting — end-to-end integration test ported from upstream's canonical injectLocalPackages.ts:218. Three-project workspace with a peer-dep chain, asserting file: resolutions, peer-suffix shape, the recorded settings.injectWorkspacePackages: true in the lockfile, and the Windows-safe slot-name escape.
• dependencies_meta_injected_per_dep_overrides_global_off — per-dep integration test: two-project workspace with injectWorkspacePackages: false (explicit) + per-dep dependenciesMeta.project-1.injected = true. The lockfile must record project-1 as a file: resolution inside project-2's importer block. Pins that the per-dep flag flowed from manifest read all the way to resolver output.
• to_virtual_store_name unit test pins the file:-+-peer-suffix → file+-prefixed slot name on every platform.
• Existing inject_workspace_packages_writes_file_resolution and injected_workspace_match_emits_file_resolution resolver tests still pass.
• All 1147 affected-crate tests pass (pacquet-config, pacquet-lockfile, pacquet-package-manager, pacquet-resolving-npm-resolver, pacquet-resolving-deps-resolver, pacquet-workspace-state, pacquet-cli).
• just dylint (perfectionist lints) clean.
• cargo clippy --all-targets -- -D warnings clean on touched crates.
• cargo fmt --check clean.

Written by an agent (Claude Code, claude-opus-4-7).

Summary by CodeRabbit

• New Features

  • Added injectWorkspacePackages setting to control whether workspace packages are materialized as file: resolutions and recorded in lockfiles.

• Bug Fixes

  • Freshness checks and install flows now respect this setting to avoid stale or incorrect installs.

• Tests

  • Added unit and end-to-end tests for YAML parsing, per-dependency overrides, lockfile writing, install behavior, and freshness checks.

• Other

  • Improved virtual-store filename escaping for safer directory names.