Support injected workspace packages in pnpm policy

genie/ci-scripts/ci-measurement-comparison.test.sh

@@ -7,19 +7,35 @@ cd "$ROOT"
 tmp_dir="$(mktemp -d)"
 trap 'rm -rf "$tmp_dir"' EXIT
 
-run_bun() {
+run_bun_to_file() {
+  local output_file="$1"
+  local script_file="$2"
+
   if command -v bun >/dev/null 2>&1; then
-    bun "$@"
+    bun "$script_file" >"$output_file"
+  elif command -v nix >/dev/null 2>&1; then
+    nix run nixpkgs#bun -- "$script_file" >"$output_file"
   elif [ -n "${DEVENV_BIN:-}" ]; then
-    "$DEVENV_BIN" shell --no-reload -- bun "$@"
+    "$DEVENV_BIN" shell --no-reload -- bash -lc 'bun "$1" > "$2"' bash "$script_file" "$output_file"
   else
-    echo "bun is not available and DEVENV_BIN is not set" >&2
+    echo "bun is not available and neither nix nor DEVENV_BIN is set" >&2
     return 127
   fi
 }
 
 emit_compare_script() {
-  run_bun -e "import { compareCiMeasurementsStep } from './genie/ci-workflow/measurements.ts'; process.stdout.write(compareCiMeasurementsStep({ currentDir: '$tmp_dir/current', baselineDir: '$tmp_dir/baseline', outputFile: '$tmp_dir/comparison.json', regressionMode: 'warn' }).run)" >"$tmp_dir/compare.sh"
+  local emitter="$tmp_dir/emit-compare.ts"
+  cat >"$emitter" <<TS
+import { compareCiMeasurementsStep } from '$ROOT/genie/ci-workflow/measurements.ts'
+
+process.stdout.write(compareCiMeasurementsStep({
+  currentDir: '$tmp_dir/current',
+  baselineDir: '$tmp_dir/baseline',
+  outputFile: '$tmp_dir/comparison.json',
+  regressionMode: 'warn',
+}).run)
+TS
+  run_bun_to_file "$tmp_dir/compare.sh" "$emitter"
 }
 
 write_measurement() {

genie/external.ts

@@ -288,6 +288,14 @@ export const commonPnpmPolicySettings = {
       '@effect/rpc': '>=0.73.0',
     },
   },
+  /**
+   * Materialize workspace deps as pnpm-injected package snapshots instead of
+   * plain source symlinks. This is required for the pure Nix/FOD package
+   * closure model: a package-local dependency build must hash every workspace
+   * package it consumes as dependency input, not accidentally reach outside the
+   * staged closure through a live symlink.
+   */
+  injectWorkspacePackages: true as const,
   enableGlobalVirtualStore: true as const,
   storeDir: '.devenv/pnpm-store-pure-v1',
   packageImportMethod: 'clone-or-copy' as const,

nix/oxc-config-plugin.nix

@@ -28,7 +28,7 @@ let
     pnpm = pinnedPnpm;
   };
   packageDir = "packages/@overeng/oxc-config";
-  pnpmDepsHash = "sha256-0FpUv8pn7KNn9PdP5BzwDX2BUtgA/p56lv7eLEG1gio=";
+  pnpmDepsHash = "sha256-UPDXMkAo6ZbawNzCZRiQ7066m6fo+Shq6CfhMHHx07w=";
 
   srcPath =
     if builtins.isAttrs src && builtins.hasAttr "outPath" src then

packages/@overeng/genie/nix/build.nix

@@ -25,7 +25,7 @@ let
     # Managed by the repo FOD refresh workflow — do not edit manually.
     depsBuilds = {
       "." = {
-        hash = "sha256-CJRcbIEpZes3jsGGYuhA6VhMY4AMxDEK+Fqpa/S7V8s=";
+        hash = "sha256-D7Z0w54Tn/LmKVZuun9ndutkAtJGM/dkDEAfKcgfJ1Q=";
       };
     };
     nativeNodePackages = [ opentuiCoreNative ];

packages/@overeng/genie/src/runtime/pnpm-workspace/mod.ts

@@ -113,6 +113,19 @@ export interface PnpmSettings {
    */
   nodeLinker?: 'hoisted' | 'isolated' | 'pnp'
 
+  /**
+   * Hard-link local workspace dependencies as injected package snapshots
+   * instead of resolving them as plain live symlinks.
+   *
+   * This is a packaging-purity control for Nix/FOD package closures: when a
+   * package is built from a reduced package-local workspace, every consumed
+   * workspace package must be represented in the dependency graph and lockfile
+   * instead of being reached through an unstaged source path.
+   *
+   * @see https://pnpm.io/settings#inject-workspace-packages
+   */
+  injectWorkspacePackages?: boolean
+
   /**
    * Pnpm-lock.yaml will be deterministic and independent of system environment.
    * @see https://pnpm.io/settings#use-lockfile-v6
@@ -699,6 +712,19 @@ export interface PnpmWorkspaceData {
    */
   nodeLinker?: 'hoisted' | 'isolated' | 'pnp'
 
+  /**
+   * Hard-link local workspace dependencies as injected package snapshots
+   * instead of resolving them as plain live symlinks.
+   *
+   * This is a packaging-purity control for Nix/FOD package closures: when a
+   * package is built from a reduced package-local workspace, every consumed
+   * workspace package must be represented in the dependency graph and lockfile
+   * instead of being reached through an unstaged source path.
+   *
+   * @see https://pnpm.io/settings#inject-workspace-packages
+   */
+  injectWorkspacePackages?: boolean
+
   /**
    * Store dependency contents in a global content-addressed store keyed by
    * dependency graph hash. Required for identity convergence: equivalent
@@ -980,6 +1006,10 @@ const buildPnpmWorkspaceYaml = <T extends PnpmWorkspaceData>({
     result.nodeLinker = data.nodeLinker
   }
 
+  if (data.injectWorkspacePackages !== undefined) {
+    result.injectWorkspacePackages = data.injectWorkspacePackages
+  }
+
   if (data.enableGlobalVirtualStore !== undefined) {
     result.enableGlobalVirtualStore = data.enableGlobalVirtualStore
   }

packages/@overeng/megarepo/nix/build.nix

@@ -24,7 +24,7 @@ let
     # Managed by the repo FOD refresh workflow — do not edit manually.
     depsBuilds = {
       "." = {
-        hash = "sha256-l3vx+W5mdMqQjTkRQZT15ic9suFBFMPL12FW4NjekDQ=";
+        hash = "sha256-AgCjUDGkQ115HNjU9GSRRKkJEofXLgaHzEtObR54Nmo=";
       };
     };
     nativeNodePackages = [ opentuiCoreNative ];

packages/@overeng/notion-cli/nix/build.nix

@@ -21,7 +21,7 @@ let
     # Managed by the repo FOD refresh workflow — do not edit manually.
     depsBuilds = {
       "." = {
-        hash = "sha256-VrpW4MT6ZDqpsE7Utu/CXXA1UOSJsD+HDHXEPZ/lp9g=";
+        hash = "sha256-Nzrd6Wz7OWympJSsLBU0uodHL5/v1fgfvBvx/Q9IBf4=";
       };
     };
     nativeNodePackages = [ opentuiCoreNative ];

packages/@overeng/notion-md/nix/build.nix

@@ -20,7 +20,7 @@ let
     # Managed by the repo FOD refresh workflow — do not edit manually.
     depsBuilds = {
       "." = {
-        hash = "sha256-kP5yTW/T7gelOOPjXjzi0DCs2qb2lejvTTjvSiveTeY=";
+        hash = "sha256-jU1WCdUEuiPC6EJRfbg8poF+JGVR8+KJ7ACnmjsnerw=";
       };
     };
     smokeTestArgs = [ "--help" ];

packages/@overeng/tui-stories/nix/build.nix

@@ -21,7 +21,7 @@ let
     # Managed by the repo FOD refresh workflow — do not edit manually.
     depsBuilds = {
       "." = {
-        hash = "sha256-vbypLXWgCH8YNb7nxLg1o3eHWwys3oqVhqBnr0dDEGs=";
+        hash = "sha256-0VxYgFoPszkCa1bpaSEWGFm5TBIO1g8CMDhVzrKNVx8=";
       };
     };
     nativeNodePackages = [ opentuiCoreNative ];