Add packageManager field support for Node.js package manager detection (#34)

Author: Copilot

cli/docs/commands/deps.md

@@ -7,7 +7,7 @@ The `deps` command automatically detects project types and installs all dependen
 ## Purpose
 
 - **Auto-Detection**: Automatically identify project types in your workspace
-- **Package Manager Selection**: Choose the correct package manager based on lock files
+- **Package Manager Selection**: Choose the correct package manager based on package.json packageManager field or lock files
 - **Multi-Project Support**: Handle multiple projects with different languages
 - **Dependency Installation**: Install all required dependencies
 - **Virtual Environment Setup**: Create Python virtual environments automatically
@@ -98,10 +98,11 @@ This command has no additional flags. It automatically detects and installs depe
                             ↓
 ┌─────────────────────────────────────────────────────────────┐
 │  Detection Priority:                                         │
-│  1. pnpm-lock.yaml → pnpm                                    │
-│  2. yarn.lock → yarn                                         │
-│  3. package-lock.json → npm                                  │
-│  4. package.json → npm (default)                             │
+│  1. packageManager field in package.json (e.g., "pnpm@8.15") │
+│  2. pnpm-lock.yaml → pnpm                                    │
+│  3. yarn.lock → yarn                                         │
+│  4. package-lock.json → npm                                  │
+│  5. package.json → npm (default)                             │
 └─────────────────────────────────────────────────────────────┘
                             ↓
                     ┌───────┴────────┐
@@ -657,12 +658,16 @@ npm install -g pnpm
 
 ### Issue: Wrong package manager detected
 
-**Cause**: Multiple lock files exist
+**Cause**: Multiple lock files exist or packageManager field in package.json is incorrect
 
 **Solution**:
 ```bash
-# Clean up conflicting lock files
+# Option 1: Set explicit packageManager in package.json (recommended)
 cd src/web
+# Edit package.json and add:
+# "packageManager": "pnpm@8.15.0"
+
+# Option 2: Clean up conflicting lock files
 rm package-lock.json  # If using pnpm
 # Keep only one lock file type
 ```

cli/src/internal/detector/detector.go

@@ -169,22 +169,28 @@ func FindNodeProjects(rootDir string) ([]types.NodeProject, error) {
 }
 
 // DetectNodePackageManager determines whether to use pnpm, yarn, or npm.
-// Priority: pnpm-lock.yaml or pnpm-workspace.yaml > yarn.lock > package-lock.json > npm (default).
+// Priority: packageManager field in package.json > lock files > npm (default).
 func DetectNodePackageManager(projectDir string) string {
 	// Use unbounded search (for backward compatibility with tests)
 	return DetectNodePackageManagerWithBoundary(projectDir, "")
 }
 
 // DetectNodePackageManagerWithBoundary determines package manager by checking only the project directory.
 // Does not search up the directory tree to avoid interference from parent workspace configurations.
+// Priority: packageManager field in package.json > lock files > npm (default).
 func DetectNodePackageManagerWithBoundary(projectDir string, boundaryDir string) string {
 	// Clean the paths to absolute
 	absDir, err := filepath.Abs(projectDir)
 	if err != nil {
 		absDir = projectDir
 	}
 
-	// Check ONLY the project directory itself for lock files
+	// First, check for packageManager field in package.json (highest priority)
+	if pkgMgr := getPackageManagerFromPackageJson(absDir); pkgMgr != "" {
+		return pkgMgr
+	}
+
+	// Fall back to lock file detection
 	// Priority: pnpm-lock.yaml > yarn.lock > package-lock.json > npm (default)
 	if _, err := os.Stat(filepath.Join(absDir, "pnpm-lock.yaml")); err == nil {
 		return "pnpm"
@@ -200,6 +206,54 @@ func DetectNodePackageManagerWithBoundary(projectDir string, boundaryDir string)
 	return "npm"
 }
 
+// getPackageManagerFromPackageJson reads package.json and extracts the packageManager field.
+// The packageManager field format is: "name@version" (e.g., "pnpm@8.15.0", "yarn@4.1.0", "npm@10.5.0")
+// Returns the package manager name (without version) if found, empty string otherwise.
+func getPackageManagerFromPackageJson(projectDir string) string {
+	packageJsonPath := filepath.Join(projectDir, "package.json")
+
+	// Validate path before reading
+	if err := security.ValidatePath(packageJsonPath); err != nil {
+		return ""
+	}
+
+	// #nosec G304 -- Path validated by security.ValidatePath
+	data, err := os.ReadFile(packageJsonPath)
+	if err != nil {
+		return ""
+	}
+
+	var pkg struct {
+		PackageManager string `json:"packageManager"`
+	}
+
+	if err := json.Unmarshal(data, &pkg); err != nil {
+		return ""
+	}
+
+	// The packageManager field is in the format "name@version"
+	// We need to extract just the name part
+	if pkg.PackageManager == "" {
+		return ""
+	}
+
+	// Split by '@' to extract the package manager name from "name@version" format
+	// (e.g., "npm@8.19.2" -> "npm")
+	parts := strings.Split(pkg.PackageManager, "@")
+
+	// The package manager name is the first part
+	pkgMgrName := parts[0]
+
+	// Validate it's a supported package manager
+	switch pkgMgrName {
+	case "npm", "yarn", "pnpm":
+		return pkgMgrName
+	default:
+		// Unsupported package manager, fall back to lock file detection
+		return ""
+	}
+}
+
 // FindDotnetProjects searches for .csproj and .sln files.
 // Only searches within rootDir and does not traverse outside it.
 func FindDotnetProjects(rootDir string) ([]types.DotnetProject, error) {

cli/src/internal/detector/detector_test.go

@@ -392,3 +392,152 @@ func TestFindAppHost(t *testing.T) {
 		t.Error("FindAppHost() ProjectFile is empty, expected .csproj path")
 	}
 }
+
+func TestGetPackageManagerFromPackageJson(t *testing.T) {
+	tests := []struct {
+		name     string
+		content  string
+		expected string
+	}{
+		{
+			name:     "packageManager field with npm",
+			content:  `{"name": "test", "packageManager": "npm@10.5.0"}`,
+			expected: "npm",
+		},
+		{
+			name:     "packageManager field with yarn",
+			content:  `{"name": "test", "packageManager": "yarn@4.1.0"}`,
+			expected: "yarn",
+		},
+		{
+			name:     "packageManager field with pnpm",
+			content:  `{"name": "test", "packageManager": "pnpm@8.15.0"}`,
+			expected: "pnpm",
+		},
+		{
+			name:     "no packageManager field",
+			content:  `{"name": "test", "version": "1.0.0"}`,
+			expected: "",
+		},
+		{
+			name:     "empty packageManager field",
+			content:  `{"name": "test", "packageManager": ""}`,
+			expected: "",
+		},
+		{
+			name:     "unsupported package manager",
+			content:  `{"name": "test", "packageManager": "bun@1.0.0"}`,
+			expected: "",
+		},
+		{
+			name:     "invalid JSON",
+			content:  `{invalid json}`,
+			expected: "",
+		},
+		{
+			name:     "packageManager without version",
+			content:  `{"name": "test", "packageManager": "pnpm"}`,
+			expected: "pnpm",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Create temporary directory
+			tmpDir, err := os.MkdirTemp("", "detector-test-*")
+			if err != nil {
+				t.Fatalf("failed to create temp dir: %v", err)
+			}
+			defer func() { _ = os.RemoveAll(tmpDir) }()
+
+			// Create package.json
+			packageJsonPath := filepath.Join(tmpDir, "package.json")
+			if err := os.WriteFile(packageJsonPath, []byte(tt.content), 0600); err != nil {
+				t.Fatalf("failed to create package.json: %v", err)
+			}
+
+			// Test detection
+			result := getPackageManagerFromPackageJson(tmpDir)
+			if result != tt.expected {
+				t.Errorf("getPackageManagerFromPackageJson() = %q, want %q", result, tt.expected)
+			}
+		})
+	}
+}
+
+func TestDetectNodePackageManagerWithPackageManagerField(t *testing.T) {
+	tests := []struct {
+		name        string
+		packageJson string
+		lockFiles   []string
+		expected    string
+	}{
+		{
+			name:        "packageManager field takes priority over lock files",
+			packageJson: `{"name": "test", "packageManager": "yarn@4.1.0"}`,
+			lockFiles:   []string{"pnpm-lock.yaml", "package-lock.json"},
+			expected:    "yarn",
+		},
+		{
+			name:        "fallback to pnpm lock file when no packageManager field",
+			packageJson: `{"name": "test"}`,
+			lockFiles:   []string{"pnpm-lock.yaml"},
+			expected:    "pnpm",
+		},
+		{
+			name:        "fallback to yarn lock file when no packageManager field",
+			packageJson: `{"name": "test"}`,
+			lockFiles:   []string{"yarn.lock"},
+			expected:    "yarn",
+		},
+		{
+			name:        "fallback to npm lock file when no packageManager field",
+			packageJson: `{"name": "test"}`,
+			lockFiles:   []string{"package-lock.json"},
+			expected:    "npm",
+		},
+		{
+			name:        "default to npm when no packageManager field and no lock files",
+			packageJson: `{"name": "test"}`,
+			lockFiles:   []string{},
+			expected:    "npm",
+		},
+		{
+			name:        "packageManager field with pnpm overrides yarn lock",
+			packageJson: `{"name": "test", "packageManager": "pnpm@8.15.0"}`,
+			lockFiles:   []string{"yarn.lock"},
+			expected:    "pnpm",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Create temporary directory
+			tmpDir, err := os.MkdirTemp("", "detector-test-*")
+			if err != nil {
+				t.Fatalf("failed to create temp dir: %v", err)
+			}
+			defer func() { _ = os.RemoveAll(tmpDir) }()
+
+			// Create package.json
+			packageJsonPath := filepath.Join(tmpDir, "package.json")
+			if err := os.WriteFile(packageJsonPath, []byte(tt.packageJson), 0600); err != nil {
+				t.Fatalf("failed to create package.json: %v", err)
+			}
+
+			// Create lock files
+			for _, lockFile := range tt.lockFiles {
+				lockPath := filepath.Join(tmpDir, lockFile)
+				if err := os.WriteFile(lockPath, []byte(""), 0600); err != nil {
+					t.Fatalf("failed to create lock file %s: %v", lockFile, err)
+				}
+			}
+
+			// Test detection
+			result := DetectNodePackageManagerWithBoundary(tmpDir, "")
+			if result != tt.expected {
+				t.Errorf("DetectNodePackageManagerWithBoundary() = %q, want %q", result, tt.expected)
+			}
+		})
+	}
+}