@npmcli/arborist@2.2.7

3 files changed, 24 insertions, 6 deletions

diff --git a/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js b/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js
index 17b42f81b..412d6ce8b 100644
--- a/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js
+++ b/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js
@@ -431,11 +431,13 @@ module.exports = cls => class IdealTreeBuilder extends cls {
     // ie, doing `foo@bar` we just return foo
     // but if it's a url or git, we don't know the name until we
     // fetch it and look in its manifest.
-    return Promise.all(add.map(rawSpec =>
-      this[_retrieveSpecName](npa(rawSpec))
+    return Promise.all(add.map(rawSpec => {
+      // We do NOT provide the path here, because user-additions need
+      // to be resolved relative to the CWD the user is in.
+      return this[_retrieveSpecName](npa(rawSpec))
         .then(add => this[_updateFilePath](add))
         .then(add => this[_followSymlinkPath](add))
-    )).then(add => {
+    })).then(add => {
       this[_resolvedAdd] = add
       // now add is a list of spec objects with names.
       // find a home for each of them!
diff --git a/node_modules/@npmcli/arborist/lib/arborist/reify.js b/node_modules/@npmcli/arborist/lib/arborist/reify.js
index c3ea1b43b..803fb9782 100644
--- a/node_modules/@npmcli/arborist/lib/arborist/reify.js
+++ b/node_modules/@npmcli/arborist/lib/arborist/reify.js
@@ -6,6 +6,7 @@ const rpj = require('read-package-json-fast')
 const { updateDepSpec } = require('../dep-spec.js')
 const AuditReport = require('../audit-report.js')
 const {subset} = require('semver')
+const npa = require('npm-package-arg')
 
 const {dirname, resolve, relative} = require('path')
 const {depth: dfwalk} = require('treeverse')
@@ -881,11 +882,17 @@ module.exports = cls => class Reifier extends cls {
 
     process.emit('time', 'reify:save')
 
+    // resolvedAdd is the list of user add requests, but with names added
+    // to things like git repos and tarball file/urls.  However, if the
+    // user requested 'foo@', and we have a foo@file:../foo, then we should
+    // end up saving the spec we actually used, not whatever they gave us.
     if (this[_resolvedAdd]) {
       const root = this.idealTree
       const pkg = root.package
-      for (const req of this[_resolvedAdd]) {
-        const {name, rawSpec, subSpec} = req
+      for (const { name } of this[_resolvedAdd]) {
+        const req = npa(root.edgesOut.get(name).spec, root.realpath)
+        const {rawSpec, subSpec} = req
+
         const spec = subSpec ? subSpec.rawSpec : rawSpec
         const child = root.children.get(name)
 
@@ -910,6 +917,15 @@ module.exports = cls => class Reifier extends cls {
           const save = h.https && h.auth ? `git+${h.https(opt)}`
             : h.shortcut(opt)
           updateDepSpec(pkg, name, save)
+        } else if (req.type === 'directory' || req.type === 'file') {
+          // save the relative path in package.json
+          // Normally saveSpec is updated with the proper relative
+          // path already, but it's possible to specify a full absolute
+          // path initially, in which case we can end up with the wrong
+          // thing, so just get the ultimate fetchSpec and relativize it.
+          const p = req.fetchSpec.replace(/^file:/, '')
+          const rel = relpath(root.realpath, p)
+          updateDepSpec(pkg, name, `file:${rel}`)
         } else
           updateDepSpec(pkg, name, req.saveSpec)
       }
diff --git a/node_modules/@npmcli/arborist/package.json b/node_modules/@npmcli/arborist/package.json
index 268f0e72a..35623f90c 100644
--- a/node_modules/@npmcli/arborist/package.json
+++ b/node_modules/@npmcli/arborist/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/arborist",
-  "version": "2.2.6",
+  "version": "2.2.7",
   "description": "Manage node_modules trees",
   "dependencies": {
     "@npmcli/installed-package-contents": "^1.0.7",