composer depends can't find any packages before composer install has completed

[fredden]

My composer.json:

{
    "require": {
        "doctrine/orm": "^2.12"
    }
}

Output of composer diagnose:

Checking composer.json: WARNING
No license specified, it is recommended to do so. For closed-source software you may use "proprietary" as license.
Checking platform settings: OK
Checking git settings: OK
Checking http connectivity to packagist: OK
Checking https connectivity to packagist: OK

In DiagnoseCommand.php line 117:
                                                                              
  count(): Parameter must be an array or an object that implements Countable  
                                                                              

diagnose

When I run this command:

cd $(mktemp -d)
find -ls
composer require doctrine/common
composer why -t doctrine/common
find vendor -delete
composer why -t doctrine/common
grep -rF doctrine/common

I get the following output:

Full output of reproduction steps

app@c956f5e83245:~$ cd $(mktemp -d)
app@c956f5e83245:/tmp/tmp.qO7rPA4LwR$ find -ls
  2884020      4 drwx------   2 app      app          4096 May 21 14:57 .
app@c956f5e83245:/tmp/tmp.qO7rPA4LwR$ composer require doctrine/common
Using version ^3.3 for doctrine/common
./composer.json has been created
Running composer update doctrine/common
Loading composer repositories with package information
Updating dependencies
Lock file operations: 5 installs, 0 updates, 0 removals
  - Locking doctrine/collections (1.6.8)
  - Locking doctrine/common (3.3.0)
  - Locking doctrine/event-manager (1.1.1)
  - Locking doctrine/persistence (3.0.2)
  - Locking psr/cache (1.0.1)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 5 installs, 0 updates, 0 removals
  - Installing psr/cache (1.0.1): Extracting archive
  - Installing doctrine/event-manager (1.1.1): Extracting archive
  - Installing doctrine/collections (1.6.8): Extracting archive
  - Installing doctrine/persistence (3.0.2): Extracting archive
  - Installing doctrine/common (3.3.0): Extracting archive
Generating autoload files
3 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
app@c956f5e83245:/tmp/tmp.qO7rPA4LwR$ composer why -t doctrine/common
doctrine/common 3.3.0 PHP Doctrine Common project is a library that provides additional functionality that other Doctrine projects depend on such as better reflection support, proxies and much more.
├──__root__ (requires doctrine/common ^3.3)
├──doctrine/event-manager 1.1.1 (conflicts doctrine/common <2.9@dev) (circular dependency aborted here)
└──doctrine/persistence 3.0.2 (conflicts doctrine/common <2.10) (circular dependency aborted here)
app@c956f5e83245:/tmp/tmp.qO7rPA4LwR$ find vendor -delete
app@c956f5e83245:/tmp/tmp.qO7rPA4LwR$ composer why -t doctrine/common

In BaseDependencyCommand.php line 77:
                                                            
  Could not find package "doctrine/common" in your project  
                                                            

depends [-r|--recursive] [-t|--tree] [--] <package>

app@c956f5e83245:/tmp/tmp.qO7rPA4LwR$ find -ls
  2884020      4 drwx------   2 app      app          4096 May 21 14:57 .
  2884022     16 -rw-r--r--   1 app      app         15431 May 21 14:57 ./composer.lock
  2884021      4 -rw-r--r--   1 app      app            61 May 21 14:57 ./composer.json
app@c956f5e83245:/tmp/tmp.qO7rPA4LwR$ grep -rF doctrine/common
composer.lock:            "name": "doctrine/common",
composer.lock:                "url": "https://github.com/doctrine/common.git",
composer.lock:                "url": "https://api.github.com/repos/doctrine/common/zipball/c824e95d4c83b7102d8bc60595445a6f7d540f96",
composer.lock:                "issues": "https://github.com/doctrine/common/issues",
composer.lock:                "source": "https://github.com/doctrine/common/tree/3.3.0"
composer.lock:                "doctrine/common": "<2.9@dev"
composer.lock:                "doctrine/common": "<2.10"
composer.lock:                "doctrine/common": "^3.0",
composer.json:        "doctrine/common": "^3.3"
app@c956f5e83245:/tmp/tmp.qO7rPA4LwR$ 

---

Output of `composer -vvv why -t doctrine/common` with no `vendor/composer/installed.json`

app@c956f5e83245:/tmp/tmp.qO7rPA4LwR$ composer -vvv why -t doctrine/common
Running 2.4-dev+176d25851d1f99345c652a6ecbc7c3787071218d (2022-05-13 13:55:51) with PHP 7.4.29 on Linux / 5.10.0-14-amd64
Reading ./composer.json (/tmp/tmp.qO7rPA4LwR/composer.json)
Loading config file ./composer.json (/tmp/tmp.qO7rPA4LwR/composer.json)
Checked CA file /etc/pki/tls/certs/ca-bundle.crt does not exist or it is not a file.
Checked directory /etc/pki/tls/certs/ca-bundle.crt does not exist or it is not a directory.
Checked CA file /etc/ssl/certs/ca-certificates.crt: valid
Executing command (/tmp/tmp.qO7rPA4LwR): 'git' 'branch' '-a' '--no-color' '--no-abbrev' '-v'
Executing command (/tmp/tmp.qO7rPA4LwR): git describe --exact-match --tags
Executing command (CWD): git --version
Executing command (/tmp/tmp.qO7rPA4LwR): git log --pretty="%H" -n1 HEAD --no-show-signature
Executing command (/tmp/tmp.qO7rPA4LwR): hg branch
Executing command (/tmp/tmp.qO7rPA4LwR): fossil branch list
Executing command (/tmp/tmp.qO7rPA4LwR): fossil tag list
Executing command (/tmp/tmp.qO7rPA4LwR): svn info --xml
Reading /var/www/.composer/composer.json
Loading config file /var/www/.composer/composer.json (/var/www/.composer/composer.json)
Reading /var/www/.composer/vendor/composer/installed.json
Loading plugin Ergebnis\Composer\Normalize\NormalizePlugin (from ergebnis/composer-normalize, installed globally)

In BaseDependencyCommand.php line 77:
                                                            
  [InvalidArgumentException]                                
  Could not find package "doctrine/common" in your project  
                                                            

Exception trace:
  at phar:///usr/bin/composer/src/Composer/Command/BaseDependencyCommand.php:77
 Composer\Command\BaseDependencyCommand->doExecute() at phar:///usr/bin/composer/src/Composer/Command/DependsCommand.php:55
 Composer\Command\DependsCommand->execute() at phar:///usr/bin/composer/vendor/symfony/console/Command/Command.php:298
 Symfony\Component\Console\Command\Command->run() at phar:///usr/bin/composer/vendor/symfony/console/Application.php:1015
 Symfony\Component\Console\Application->doRunCommand() at phar:///usr/bin/composer/vendor/symfony/console/Application.php:299
 Symfony\Component\Console\Application->doRun() at phar:///usr/bin/composer/src/Composer/Console/Application.php:334
 Composer\Console\Application->doRun() at phar:///usr/bin/composer/vendor/symfony/console/Application.php:171
 Symfony\Component\Console\Application->run() at phar:///usr/bin/composer/src/Composer/Console/Application.php:130
 Composer\Console\Application->run() at phar:///usr/bin/composer/bin/composer:88
 require() at /usr/bin/composer:30

depends [-r|--recursive] [-t|--tree] [--] <package>

app@c956f5e83245:/tmp/tmp.qO7rPA4LwR$ 

And I expected this to happen:

The same output as before I removed the vendor/ directory. The dependency information is stored in composer.lock but seemingly isn't read from here. A little more investigation suggests that the information is read from vendor/composer/installed.json (as deleting just this file is enough to trigger the error message here).

I noticed this behaviour (which I think is a bug) when I checked out a repository from version control and wanted to know why a particular package was included in composer.lock without manually reviewing all the entries. After (investigating the problem and then) running composer install the information was correctly reported by composer why ....

It may be that the required fix here is to update the error message to alert when vendor/composer/installed.json is absent, so that the user gets a clear direction for what to do to get the expected output from the depends command. Ideally (from my point of view) the required information is read from composer.json / composer.lock if vendor/composer/installed.json is unavailable.

[stof]

There is already a feature request related to supporting using the lock file as source at #10717

[Seldaek]

Closing in favor of #10717

[fredden]

@Seldaek please can you re-open this; I don't seem to have sufficient permissions to do so.

I acknowledge that using the lock file is a feature request. I didn't find #10717 when I searched for this initially. The error message that shows up currently needs to be improved and/or the documentation updated to show that this behaviour is expected. Even after #10717 is implemented, the error message here is confusing / misleading / not helpful. Let's get this bug fixed.

[Seldaek]

@fredden my comment on #10717 says "and if nothing is installed warns." which IMO includes a clear warning if no packages are installed, much like the show command already does.