fix: harden package-manager auto-install (review findings)

- yarn: install corepack shims into a user-owned --install-directory and
  prependPath it, so a NodeSource Linux install no longer hits EACCES writing
  to the root-owned Node bin dir.
- bun: honor $BUN_INSTALL when exposing the freshly-installed bin dir, instead
  of hardcoding ~/.bun/bin.
- orchestrator: re-check each tool after install and fail with the manual hint
  if it is still not on PATH, instead of letting the next step die with a
  confusing "command not found".
- orchestrator: single-flight installs by tool name so concurrent deploy-all
  builds sharing a missing manager don't race the same installer.
- detect: recognise bun 1.2+'s text lockfile bun.lock (not just bun.lockb).
- changeset: clarify that deploy/build auto-install while mod prompts.

Author: UtkarshBhardwaj007

.changeset/mod-package-manager-autoinstall.md

@@ -2,7 +2,9 @@
 "playground-cli": minor
 ---
 
-`playground mod` and deploy now detect the package manager a project uses
-(pnpm/yarn/bun/npm) and offer to install it — plus Node.js when needed — instead
-of failing with a confusing error when it's missing. macOS and Linux are
-supported; non-interactive runs auto-install.
+`playground mod` now detects the package manager a project uses (pnpm/yarn/bun/npm)
+and, when it (or Node.js) is missing, offers to install it with one confirmation
+before running the project's setup, instead of failing with a confusing error.
+`playground deploy` and `playground build` install a missing manager automatically
+as part of the build step. macOS and Linux are supported; non-interactive runs
+install without prompting.

src/utils/build/detect.test.ts

@@ -49,6 +49,10 @@ describe("detectPackageManager", () => {
     it("picks bun when only bun.lockb is present", () => {
         expect(detectPackageManager(new Set(["bun.lockb"]))).toBe("bun");
     });
+
+    it("picks bun when only bun.lock (bun 1.2+ text lockfile) is present", () => {
+        expect(detectPackageManager(new Set(["bun.lock"]))).toBe("bun");
+    });
 });
 
 describe("detectBuildConfig", () => {

src/utils/build/detect.ts

@@ -24,14 +24,21 @@ import { DEFAULT_BUILD_DIR } from "../../config.js";
 
 export type PackageManager = "pnpm" | "yarn" | "bun" | "npm";
 
-/** Files we inspect on disk to infer the package manager. */
+/** Canonical lockfile basename per package manager. */
 export const PM_LOCKFILES: Record<PackageManager, string> = {
     pnpm: "pnpm-lock.yaml",
     yarn: "yarn.lock",
     bun: "bun.lockb",
     npm: "package-lock.json",
 };
 
+// Bun 1.2+ defaults to a TEXT lockfile (`bun.lock`); older bun wrote the binary
+// `bun.lockb`. Detect either so modern bun projects aren't mis-detected as npm.
+const BUN_TEXT_LOCKFILE = "bun.lock";
+
+/** Every lockfile basename to probe on disk (some PMs have more than one). */
+export const PM_LOCKFILES_ALL: string[] = [...Object.values(PM_LOCKFILES), BUN_TEXT_LOCKFILE];
+
 export interface BuildConfig {
     /** Binary + args to spawn. */
     cmd: string;
@@ -80,7 +87,7 @@ export class BuildDetectError extends Error {
 export function detectPackageManager(lockfiles: Set<string>): PackageManager {
     if (lockfiles.has(PM_LOCKFILES.pnpm)) return "pnpm";
     if (lockfiles.has(PM_LOCKFILES.yarn)) return "yarn";
-    if (lockfiles.has(PM_LOCKFILES.bun)) return "bun";
+    if (lockfiles.has(PM_LOCKFILES.bun) || lockfiles.has(BUN_TEXT_LOCKFILE)) return "bun";
     return "npm";
 }
 

src/utils/build/runner.ts

@@ -25,7 +25,7 @@ import { runStreamed } from "../process.js";
 import {
     detectBuildConfig,
     detectInstallConfig,
-    PM_LOCKFILES,
+    PM_LOCKFILES_ALL,
     type BuildConfig,
     type DetectInput,
     type InstallConfig,
@@ -56,7 +56,7 @@ export function loadDetectInput(projectDir: string): DetectInput {
         : null;
 
     const lockfiles = new Set<string>();
-    for (const name of Object.values(PM_LOCKFILES)) {
+    for (const name of PM_LOCKFILES_ALL) {
         if (existsSync(join(root, name))) lockfiles.add(name);
     }
 

src/utils/packageManagers.test.ts

@@ -125,9 +125,10 @@ describe("install command builders", () => {
         expect(bunInstallCommand()).toContain("bun.sh/install");
     });
 
-    it("installs yarn via corepack (its official path)", () => {
-        expect(yarnInstallCommand()).toContain("corepack");
-        expect(yarnInstallCommand()).toContain("yarn@stable");
+    it("installs yarn via corepack into a user-owned dir (avoids EACCES on Linux)", () => {
+        const cmd = yarnInstallCommand("/home/u/.corepack/bin");
+        expect(cmd).toContain('corepack enable --install-directory "/home/u/.corepack/bin"');
+        expect(cmd).toContain("yarn@stable");
     });
 });
 
@@ -147,12 +148,16 @@ describe("PM_TOOLS — which tools each PM needs", () => {
 });
 
 function fakeTool(label: string, installed: boolean, installSpy: string[]): PmTool {
+    // Models a real tool: `check()` flips to true once `install()` has run, so
+    // the orchestrator's post-install re-check passes.
+    let present = installed;
     return {
         name: label,
         label,
-        check: async () => installed,
+        check: async () => present,
         install: async () => {
             installSpy.push(label);
+            present = true;
         },
         manualHint: `install ${label}`,
     };
@@ -213,6 +218,52 @@ describe("ensurePackageManagerForTools", () => {
         // pnpm comes after the failed Node install, so it must not have run.
         expect(installed).toEqual([]);
     });
+
+    it("throws when a tool is still missing after its install ran (PATH mismatch)", async () => {
+        const installed: string[] = [];
+        // install() "succeeds" but check() never flips — models an installer that
+        // wrote its binary somewhere not on PATH.
+        const stubborn: PmTool = {
+            name: "Node.js",
+            label: "Node.js",
+            check: async () => false,
+            install: async () => {
+                installed.push("Node.js");
+            },
+            manualHint: "https://nodejs.org/en/download",
+        };
+        await expect(ensurePackageManagerForTools("npm", [stubborn], {})).rejects.toThrow(
+            /still not on PATH/,
+        );
+        expect(installed).toEqual(["Node.js"]); // it did attempt the install
+    });
+
+    it("collapses concurrent installs of the same tool onto one run (single-flight)", async () => {
+        let installCount = 0;
+        let present = false;
+        let release!: () => void;
+        const gate = new Promise<void>((r) => {
+            release = r;
+        });
+        const make = (): PmTool => ({
+            name: "pnpm",
+            label: "pnpm",
+            check: async () => present,
+            install: async () => {
+                installCount++;
+                await gate;
+                present = true;
+            },
+            manualHint: "x",
+        });
+        // Two concurrent ensures racing the same missing tool (the deploy-all case).
+        const a = ensurePackageManagerForTools("pnpm", [make()], {});
+        const b = ensurePackageManagerForTools("pnpm", [make()], {});
+        await new Promise((r) => setTimeout(r, 10)); // let both reach the install
+        release();
+        await Promise.all([a, b]);
+        expect(installCount).toBe(1);
+    });
 });
 
 describe("planPackageManagerForTools", () => {

src/utils/packageManagers.ts

@@ -27,7 +27,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { homedir, platform } from "node:os";
 import { join, resolve } from "node:path";
-import { detectPackageManager, PM_LOCKFILES, type PackageManager } from "./build/detect.js";
+import { detectPackageManager, PM_LOCKFILES_ALL, type PackageManager } from "./build/detect.js";
 import { detectReferencedPackageManagers } from "./mod/packageManager.js";
 import { runShell } from "./process.js";
 import { sudo } from "./sudo.js";
@@ -98,9 +98,15 @@ export function pnpmInstallCommand(): string {
     return "curl -fsSL https://get.pnpm.io/install.sh | sh -";
 }
 
-/** yarn's official path: corepack ships with Node and activates a yarn shim. */
-export function yarnInstallCommand(): string {
-    return "corepack enable && corepack prepare yarn@stable --activate";
+/**
+ * yarn's official path: corepack (ships with Node) writes a yarn shim. We point
+ * `--install-directory` at a user-owned dir instead of corepack's default (the
+ * Node bin dir), because on a NodeSource Linux install that dir is root-owned
+ * and a plain `corepack enable` hits EACCES. The caller prepends `installDir`
+ * to PATH so the shim resolves. Works on macOS and Linux without sudo.
+ */
+export function yarnInstallCommand(installDir: string): string {
+    return `corepack enable --install-directory "${installDir}" && corepack prepare yarn@stable --activate`;
 }
 
 /**
@@ -157,7 +163,14 @@ const YARN_TOOL: PmTool = {
     name: "yarn",
     label: "yarn",
     check: () => commandExists("yarn"),
-    install: (onData) => runShell(yarnInstallCommand(), onData, { description: "install yarn" }),
+    install: async (onData) => {
+        const binDir = resolve(homedir(), ".corepack/bin");
+        await runShell(yarnInstallCommand(binDir), onData, { description: "install yarn" });
+        // corepack wrote the yarn shim into our user-owned --install-directory
+        // (avoids EACCES on a root-owned NodeSource bin dir); expose it now so the
+        // very next step resolves `yarn`.
+        prependPath(binDir);
+    },
     manualHint: "https://yarnpkg.com/getting-started/install",
 };
 
@@ -167,8 +180,10 @@ const BUN_TOOL: PmTool = {
     check: () => commandExists("bun"),
     install: async (onData) => {
         await runShell(bunInstallCommand(), onData, { description: "install bun" });
-        // bun's installer drops the binary in ~/.bun/bin and edits shell rc files.
-        prependPath(resolve(homedir(), ".bun/bin"));
+        // bun's installer writes the binary to $BUN_INSTALL/bin (default ~/.bun),
+        // and edits shell rc files that don't reach the running process. Honor
+        // BUN_INSTALL (the installer does) and expose the bin dir now.
+        prependPath(resolve(process.env.BUN_INSTALL ?? resolve(homedir(), ".bun"), "bin"));
     },
     manualHint: "https://bun.sh/docs/installation",
 };
@@ -219,6 +234,23 @@ export class PackageManagerUnavailableError extends Error {
     }
 }
 
+// Process-wide single-flight for installs, keyed by tool name. `deploy-all`
+// runs builds for several apps concurrently in ONE process; when they share a
+// missing PM, every worker would otherwise launch the same installer at once
+// (two `get.pnpm.io | sh` runs, or racing `sudo apt`/`dpkg` locks). Collapsing
+// concurrent installs of the same tool onto one promise makes that safe.
+const inFlightInstalls = new Map<string, Promise<void>>();
+
+function installOnce(tool: PmTool, onData?: (line: string) => void): Promise<void> {
+    const existing = inFlightInstalls.get(tool.name);
+    if (existing) return existing;
+    const p = Promise.resolve(tool.install(onData)).finally(() => {
+        inFlightInstalls.delete(tool.name);
+    });
+    inFlightInstalls.set(tool.name, p);
+    return p;
+}
+
 /** Core orchestration, parameterized on the tool list so it is trivially testable. */
 export async function ensurePackageManagerForTools(
     pm: PackageManager,
@@ -239,7 +271,23 @@ export async function ensurePackageManagerForTools(
 
     for (const tool of missing) {
         opts.onData?.(`> installing ${tool.label}`);
-        await tool.install(opts.onData);
+        await installOnce(tool, opts.onData);
+    }
+
+    // Re-verify: an installer can exit 0 yet leave the binary off the running
+    // process's PATH (e.g. a prependPath target that doesn't match where the
+    // installer actually wrote). Surface that here with the manual hint, instead
+    // of letting the next build/setup step die with a confusing "command not
+    // found" — the exact scary-error class this whole flow exists to kill.
+    const stillMissing: PmTool[] = [];
+    for (const tool of missing) {
+        if (!(await tool.check())) stillMissing.push(tool);
+    }
+    if (stillMissing.length > 0) {
+        const names = stillMissing.map((t) => t.label).join(", ");
+        throw new Error(
+            `Installed ${names} but it is still not on PATH. ${packageManagerManualHint(pm, stillMissing)}`,
+        );
     }
     return pm;
 }
@@ -284,7 +332,7 @@ export function loadPackageManagerSnapshot(projectDir: string): PmSnapshot {
         }
     }
     const lockfiles = new Set<string>();
-    for (const name of Object.values(PM_LOCKFILES)) {
+    for (const name of PM_LOCKFILES_ALL) {
         if (existsSync(join(projectDir, name))) lockfiles.add(name);
     }
     const setupPath = join(projectDir, "setup.sh");