feat(please-plugins): add monorepo workspace dependency scanning

[amondnet]

Summary

• Add workspace resolution for npm/yarn/Bun workspaces field and pnpm-workspace.yaml
• Aggregate dependencies from all workspace packages before plugin detection
• Enhance source tracking to show workspace path prefix (e.g., apps/web: @nuxt/ui)
• Integrate into both scanForSetup() and SessionStart hook

Test plan

• 62 tests passing (46 existing + 16 new)
• Workspace resolution tests for npm, pnpm, yarn formats
• Dependency aggregation with root priority
• Backward compatibility for non-monorepo projects

Closes #132

Verification Checklist

• resolveWorkspacePackages resolves npm/yarn/Bun workspaces glob patterns to directory paths
• resolveWorkspacePackages resolves pnpm-workspace.yaml patterns to directory paths
• resolveWorkspacePackages returns empty array when no workspaces configured
• collectAllDependencies merges deps from root + workspace packages
• collectAllDependencies skips missing/malformed workspace package.json
• scanForSetup detects plugins from workspace dependencies
• Source field shows workspace path prefix for workspace-origin deps
• Non-monorepo projects continue to work unchanged

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
claude-code-plugins	Ready	Preview, Comment	Mar 29, 2026 7:50am

[gemini-code-assist]

Code Review

This pull request implements monorepo workspace dependency scanning by aggregating dependencies from all workspace packages defined in package.json or pnpm-workspace.yaml. The changes update the detection logic to attribute dependencies to their specific workspace paths. Feedback highlights several improvement opportunities: the custom glob resolution should be replaced with a standard library like Bun.Glob for better robustness, the manual YAML parsing for pnpm-workspace.yaml should be made more resilient, resolved workspace paths should be deduplicated, and test assertions should be more precise regarding expected directory counts and negation patterns.

[cubic-dev-ai]

1 issue found across 7 files

Confidence score: 3/5

• There is a concrete regression risk in plugins/please-plugins/hooks/workspace-resolver.ts: glob resolution stops processing after the first *, which can misresolve non-trivial workspace patterns to the wrong directories.
• Given the issue’s medium severity (6/10) and high confidence (8/10), this introduces user-facing behavior risk in workspace discovery, so this is not fully low-risk to merge yet.
• Pay close attention to plugins/please-plugins/hooks/workspace-resolver.ts - wildcard parsing may produce incorrect directory matches for complex patterns.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="plugins/please-plugins/hooks/workspace-resolver.ts">

<violation number="1" location="plugins/please-plugins/hooks/workspace-resolver.ts:49">
P2: Glob resolution ignores everything after the first `*`, so non-trivial workspace patterns can match the wrong directories.</violation>
</file>

Architecture diagram

sequenceDiagram
    participant UI as CLI / Hook Trigger
    participant Scanner as check-dependencies.ts
    participant Resolver as NEW: workspace-resolver.ts
    participant FS as File System
    participant Maps as Plugin Mappings

    UI->>Scanner: scanForSetup(cwd) or detectForEvent()
    
    Scanner->>Resolver: NEW: collectAllDependencies(cwd)
    
    Resolver->>FS: loadPackageJson(root)
    FS-->>Resolver: root dependencies
    
    Resolver->>Resolver: NEW: resolveWorkspacePackages()
    
    alt npm / yarn / Bun
        Resolver->>Resolver: Parse "workspaces" glob patterns
    else pnpm
        Resolver->>FS: NEW: Read pnpm-workspace.yaml
        FS-->>Resolver: yaml patterns
    end

    Resolver->>FS: NEW: resolveGlobPatterns (readdirSync)
    
    loop For each resolved workspace directory
        Resolver->>FS: loadPackageJson(workspaceDir)
        alt Valid package.json
            FS-->>Resolver: workspace dependencies
            Resolver->>Resolver: NEW: Aggregate unique dependencies
            Resolver->>Resolver: NEW: Map dep to workspace source path
        else Missing or Malformed
            FS-->>Resolver: null / skip
        end
    end
    
    Resolver-->>Scanner: Return AggregatedDeps (deps + sources map)

    Scanner->>Maps: Load static mappings
    
    Scanner->>Scanner: CHANGED: detectPackages() using aggregated deps
    
    Scanner->>Scanner: NEW: resolvePackageSource()
    Note over Scanner: If dep found in workspace map,<br/>prefix source with path (e.g. "apps/web: @nuxt/ui")
    
    Scanner-->>UI: Return SetupOutput (Detected plugins with attribution)

Loading

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}