fix(install-internal-package): retarget replacement to node_modules/.pnpm

.gitignore

@@ -2,6 +2,7 @@
 
 .idea/
 .vscode/
+.DS_Store
 
 logs
 *.log

install-internal-package/replace-package.js

@@ -1,6 +1,6 @@
 const assert = require('node:assert');
 const { execFileSync } = require('node:child_process');
-const { rmSync, mkdirSync, lstatSync, unlinkSync } = require('node:fs');
+const { rmSync, mkdirSync, lstatSync, realpathSync } = require('node:fs');
 const { join } = require('node:path');
 const { createRequire } = require('node:module');
 
@@ -21,16 +21,24 @@ for (const searchDir of cwdRequire.resolve.paths(packageName) || []) {
 
 assert(entryPath, `Package "${packageName}" is not installed. It must be installed before it can be replaced.`);
 
-if (lstatSync(entryPath).isSymbolicLink()) {
-  unlinkSync(entryPath);
-} else {
-  rmSync(entryPath, { recursive: true, force: true });
-}
+const targetPath = (() => {
+  if (!lstatSync(entryPath).isSymbolicLink()) {
+    return entryPath;
+  }
+
+  // If it's a symlink (pnpm), replace the target content to preserve the resolution chain.
+  // pnpm places dependencies as siblings of the target, so the symlink must stay intact.
+  const resolved = realpathSync(entryPath);
+  assert(resolved.startsWith(process.cwd() + '/'), `Symlink target "${resolved}" resolves outside the project`);
+  return resolved;
+
+})();
 
-mkdirSync(entryPath, { recursive: true });
+rmSync(targetPath, { recursive: true, force: true });
+mkdirSync(targetPath, { recursive: true });
 
 const listing = execFileSync('tar', ['-tzf', packageFile]).toString();
 const unsafeEntry = listing.split('\n').find(e => e.includes('..') || e.startsWith('/'));
 assert(!unsafeEntry, `Archive contains unsafe path: ${unsafeEntry}`);
 
-execFileSync('tar', ['-xzf', packageFile, '-C', entryPath, '--strip-components=1']);
+execFileSync('tar', ['-xzf', packageFile, '-C', targetPath, '--strip-components=1']);