feat(install): resolve install-dir collisions

[kjanat]

What

node_modules/vendor install-dir collisions (bun + deno both writing
node_modules, for example) are now an install-time verdict computed
against the effective PM set, instead of a detection-time warning that
every command flushed. Before, run/list/doctor nagged about an
install-time hazard they cannot act on, and [install].pms never
silenced it.

Changes

• ctx.install_dirs records writers per dir as a fact;
  cmd::install::plan_install picks a winner and shadows the rest.
• [install].on_collision = resolve (default) or error, plus
  RUNNER_INSTALL_ON_COLLISION. resolve picks the resolver's node PM
  (non-deno unless [pm].node = "deno"); error exits non-zero.
• Writers of one dir install serially; distinct dirs still overlap.
  Install reaps a running child on wait error instead of orphaning it.
• doctor reports the plan (install set, shadowed dir). The collision
  warning is confined to install and doctor, printed once per
  project root across nested runners.

Detection

• deno writes node_modules whenever a package.json is present (the
  documented default is manual mode), not only on explicit
  nodeModulesDir.
• Two node lockfiles resolve by which one git tracks, ahead of the
  bun > pnpm > yarn > npm order.
• Prerelease PM builds satisfy devEngines version ranges.

Housekeeping

• Schema-facing descriptions via schemars(description) rather than
  post-hoc JSON stripping.
• Em-dashes removed repo-wide, and the comma splices that removal left
  behind are fixed.
• Publishing pinned to npm 11.

Testing

cargo test, cargo clippy --all-targets, cargo fmt --check, and
the schema drift guard all pass.

Commits: feat(install) 3176dda, refactor(install) abf22a1, style
7307be2, fix(release) f265f05.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	runner	d5bcdea	Commit Preview URL Branch Preview URL	Jul 16 2026, 02:10 AM

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 965cbbc3-a156-4056-a664-8770139bfb78

📥 Commits

Reviewing files that changed from the base of the PR and between 7307be2 and d5bcdea.

📒 Files selected for processing (28)

• CHANGELOG.md
• rust-toolchain.toml
• schemas/doctor.example.json
• schemas/doctor.schema.json
• schemas/list.example.json
• schemas/list.schema.json
• schemas/why.example.json
• schemas/why.schema.json
• site/src/index.html
• src/chain/exec.rs
• src/cli.rs
• src/cmd/doctor.rs
• src/cmd/install.rs
• src/cmd/list.rs
• src/cmd/schema.rs
• src/cmd/why.rs
• src/detect.rs
• src/schema/doctor.rs
• src/schema/mod.rs
• src/schema/project.rs
• src/tool/deno.rs
• src/tool/mod.rs
• src/tool/node.rs
• src/types.rs
• tests/docker/README.md
• tests/fixtures/chain-parallel-fail/runner.toml
• tests/install_collision.rs
• tests/nested_warnings.rs

📜 Recent review details

⏰ Context from checks skipped due to timeout. (1)

• GitHub Check: Workers Builds: runner

🧰 Additional context used

📓 Path-based instructions (1)

**/CHANGELOG.md

📄 CodeRabbit inference engine (Custom checks)

**/CHANGELOG.md: If any source code files (excluding tests, docs, CI, markdown, or comments-only changes) are modified, CHANGELOG.md MUST also be modified in the same PR.
If a version bump is detected, CHANGELOG.md MUST contain a new section header matching the exact new version number in the format: '## [X.Y.Z] - YYYY-MM-DD'.
If NO version bump is detected, the changes in the PR MUST be added under the existing '## [Unreleased]' section in CHANGELOG.md. The entry MUST describe the changes (e.g., Added, Changed, Fixed, Removed).

Files:

• CHANGELOG.md

🧠 Learnings (7)

📚 Learning: 2026-03-26T20:05:44.851Z

Learnt from: kjanat
Repo: kjanat/runner PR: 1
File: src/cmd/mod.rs:67-75
Timestamp: 2026-03-26T20:05:44.851Z
Learning: In Rust, `std::process::Command` does not provide getters for stdio configuration, so whether `Stdio::inherit()` (or other `Stdio::*` settings) was applied cannot be asserted via pure unit tests without spawning a process and inspecting OS-level fds. When reviewing Rust code, do not flag “missing unit test coverage” for stdio configuration on `std::process::Command` as a code issue—treat the explicit `Command::stdin/stdout/stderr` setter calls in the source as the meaningful guarantee.

Applied to files:

• src/tool/mod.rs
• tests/nested_warnings.rs
• src/chain/exec.rs
• src/cmd/list.rs
• src/cmd/why.rs
• tests/install_collision.rs
• src/cmd/doctor.rs
• src/tool/deno.rs
• src/schema/project.rs
• src/tool/node.rs
• src/cli.rs
• src/schema/doctor.rs
• src/detect.rs
• src/types.rs
• src/cmd/schema.rs
• src/cmd/install.rs
• src/schema/mod.rs

📚 Learning: 2026-04-21T15:16:40.277Z

Learnt from: kjanat
Repo: kjanat/runner PR: 4
File: src/tool/just.rs:132-133
Timestamp: 2026-04-21T15:16:40.277Z
Learning: In Rust, if a method like `ExtractedTask::name() -> &str` returns a borrowed `&str` tied to `&self`, then using `sort_unstable_by_key(|t| t.name())` should be avoided because `by_key` requires the key to not borrow from the element being sorted (it will fail to compile due to the key’s lifetime). Do not recommend `sort_unstable_by_key` as a simplification in this situation. If you need an allocation-free and idiomatic comparison, use `sort_unstable_by(|a, b| a.name().cmp(b.name()))` instead. Using `.to_owned()` inside `by_key` is an alternative but allocates a `String` per element.

Applied to files:

• src/tool/mod.rs
• tests/nested_warnings.rs
• src/chain/exec.rs
• src/cmd/list.rs
• src/cmd/why.rs
• tests/install_collision.rs
• src/cmd/doctor.rs
• src/tool/deno.rs
• src/schema/project.rs
• src/tool/node.rs
• src/cli.rs
• src/schema/doctor.rs
• src/detect.rs
• src/types.rs
• src/cmd/schema.rs
• src/cmd/install.rs
• src/schema/mod.rs

📚 Learning: 2026-05-04T23:28:17.947Z

Learnt from: kjanat
Repo: kjanat/runner PR: 5
File: src/lib.rs:222-223
Timestamp: 2026-05-04T23:28:17.947Z
Learning: When reviewing Rust `rustdoc` comments (`/// ...`), treat a trailing backslash (`\`) at the end of a comment line as valid CommonMark syntax for a hard line break (rendered as `<br>`). Do not flag such trailing backslashes as papercuts or recommend removing them unless there is clear evidence they are unintended (e.g., they are not in the `rustdoc` comment context or the surrounding formatting contradicts the intended CommonMark hard-break usage).

Applied to files:

• src/tool/mod.rs
• tests/nested_warnings.rs
• src/chain/exec.rs
• src/cmd/list.rs
• src/cmd/why.rs
• tests/install_collision.rs
• src/cmd/doctor.rs
• src/tool/deno.rs
• src/schema/project.rs
• src/tool/node.rs
• src/cli.rs
• src/schema/doctor.rs
• src/detect.rs
• src/types.rs
• src/cmd/schema.rs
• src/cmd/install.rs
• src/schema/mod.rs

📚 Learning: 2026-06-01T17:42:48.461Z

Learnt from: kjanat
Repo: kjanat/runner PR: 34
File: Cargo.toml:61-61
Timestamp: 2026-06-01T17:42:48.461Z
Learning: In this repo, do not flag `actions_rs::log::GroupGuard` or `actions_rs::log::group_guard` as missing/non-existent when they are referenced in Rust code, because the `actions-rs` crate (dependency `actions-rs = "0.1"` / published v0.1.x) exports `pub struct GroupGuard` and `pub fn group_guard` from `actions_rs::log` (and also exports `actions_rs::env::is_github_actions`). This avoids false positives from outdated/incorrect web search results. If the repo does not depend on `actions-rs = "0.1"` in `Cargo.toml`, then normal missing-import/item checks can apply.

Applied to files:

• src/tool/mod.rs
• tests/nested_warnings.rs
• src/chain/exec.rs
• src/cmd/list.rs
• src/cmd/why.rs
• tests/install_collision.rs
• src/cmd/doctor.rs
• src/tool/deno.rs
• src/schema/project.rs
• src/tool/node.rs
• src/cli.rs
• src/schema/doctor.rs
• src/detect.rs
• src/types.rs
• src/cmd/schema.rs
• src/cmd/install.rs
• src/schema/mod.rs

📚 Learning: 2026-06-11T18:52:28.233Z

Learnt from: kjanat
Repo: kjanat/runner PR: 45
File: src/lib.rs:659-661
Timestamp: 2026-06-11T18:52:28.233Z
Learning: In Rust, it’s acceptable to use `matches!(cli.command, Some(cli::Command::Doctor { .. }))` (or similar) when the scrutinee comes from a field accessed through a shared reference (e.g., `cli: &Cli`). If the match pattern uses `..` and binds zero fields (so only the enum discriminant is matched), Rust match ergonomics will avoid moving out of the referenced value. Reviewers should not flag such code as a compile-blocking move; confirm with `cargo check` rather than forcing changes like `.as_ref()` when compilation succeeds.

Applied to files:

• src/tool/mod.rs
• tests/nested_warnings.rs
• src/chain/exec.rs
• src/cmd/list.rs
• src/cmd/why.rs
• tests/install_collision.rs
• src/cmd/doctor.rs
• src/tool/deno.rs
• src/schema/project.rs
• src/tool/node.rs
• src/cli.rs
• src/schema/doctor.rs
• src/detect.rs
• src/types.rs
• src/cmd/schema.rs
• src/cmd/install.rs
• src/schema/mod.rs

📚 Learning: 2026-05-15T01:31:48.037Z

Learnt from: kjanat
Repo: kjanat/runner PR: 27
File: src/types.rs:584-585
Timestamp: 2026-05-15T01:31:48.037Z
Learning: In the `kjanat/runner` Rust codebase, remember that `just` treats its `justfile` name as officially case-insensitive and allows the hidden variant: `justfile`, `Justfile`, `JUSTFILE`, etc., and `.justfile`. `TaskSource::Justfile` detection should recognize these filename variants. Also note that `from_label` in `src/types.rs` is for parsing user-supplied qualifier prefixes (e.g. `justfile:build`), not for detecting the on-disk justfile. If you add/adjust qualifier label emission for `TaskSource::Justfile`, it’s not strictly required for backward compatibility because `TaskSource::label()` previously only emitted lowercase `"justfile"`, but adding additional casing/hidden variants as a defensive UX improvement is consistent with `just`’s official support.

Applied to files:

• src/tool/mod.rs
• src/chain/exec.rs
• src/cmd/list.rs
• src/cmd/why.rs
• src/cmd/doctor.rs
• src/tool/deno.rs
• src/schema/project.rs
• src/tool/node.rs
• src/cli.rs
• src/schema/doctor.rs
• src/detect.rs
• src/types.rs
• src/cmd/schema.rs
• src/cmd/install.rs
• src/schema/mod.rs

📚 Learning: 2026-05-14T15:35:39.922Z

Learnt from: kjanat
Repo: kjanat/runner PR: 27
File: src/cmd/run.rs:206-212
Timestamp: 2026-05-14T15:35:39.922Z
Learning: For Go projects using the canonical `cmd/` layout, when `runner` dispatches a local Go tool by its bare name (e.g., `some-cli`) under `PackageManager::Go`, resolve it relative to `ctx.root` by probing `ctx.root/cmd/<task_name>/`. If it exists, run the tool with the filesystem-path form: `go run ./cmd/<task_name>` (note the leading `./`). Do NOT generate `go run <task_name>` because bare names are treated as Go import paths, not local directories. While `go run <module>/cmd/<task_name>` can work, it’s unnecessary for local development—prefer `./cmd/<task_name>`.

Applied to files:

• src/cmd/list.rs
• src/cmd/why.rs
• src/cmd/doctor.rs
• src/cmd/schema.rs
• src/cmd/install.rs

🪛 LanguageTool

tests/docker/README.md

[uncategorized] ~14-~14: Possible missing comma found.
Context: ...pends entirely on the installed package set containing only `@runner-run/linux-x64-...

(AI_HYDRA_LEO_MISSING_COMMA)

---

[uncategorized] ~34-~34: Loose punctuation mark.
Context: ...-test . ``` - --build-arg VER=<x.y.z>: Test a specific published version (defa...

(UNLIKELY_OPENING_PUNCTUATION)

---

[uncategorized] ~35-~35: Loose punctuation mark.
Context: ....10.0). - --progress=plain --no-cache`: Use these flags to see the per-stage di...

(UNLIKELY_OPENING_PUNCTUATION)

---

[uncategorized] ~36-~36: Loose punctuation mark.
Context: ...er-stage diagnostics. - --network=host: Use this only where Docker's bridge/vet...

(UNLIKELY_OPENING_PUNCTUATION)

🔍 Remote MCP GitHub Grep

Additional review context

• git ls-files -z is used in multiple production repositories with null-delimited consumers (xargs -0, mapfile -d ''), supporting the PR’s newline-safe tracked-file enumeration approach.
• std::thread::scope is a conventional Rust pattern for spawning scoped worker threads and joining them safely; examples appear in Rust, PyO3, Gitoxide, and Rayon.
• Deno’s current configuration model defines nodeModulesDir modes as Auto, Manual, and None, corroborating the PR’s explicit handling of these values.
• No public GitHub matches were found for the PR-specific RUNNER_INSTALL_ON_COLLISION identifier.

🔇 Additional comments (34)

rust-toolchain.toml (1)

2-2: LGTM!

tests/fixtures/chain-parallel-fail/runner.toml (1)

3-4: LGTM!

site/src/index.html (1)

6-9: LGTM!

Also applies to: 22-22, 63-63, 99-99, 194-203

src/chain/exec.rs (1)

33-34: LGTM!

Also applies to: 46-46, 140-140, 157-159, 270-270, 315-315, 506-506, 518-518

CHANGELOG.md (1)

12-60: LGTM!

Also applies to: 96-96, 131-131, 141-154, 165-172, 188-188, 208-208, 229-236, 247-247, 256-262, 339-347, 364-364, 379-381, 399-417, 435-435, 448-449, 467-467, 482-482, 500-500, 521-521, 563-564, 580-581, 592-592, 609-609, 618-618, 641-642, 653-653, 677-704, 718-719, 741-741, 768-775, 785-785, 804-804, 851-856, 881-887, 941-949, 973-984, 1038-1038, 1087-1087, 1096-1096, 1107-1114, 1148-1149, 1285-1285, 1298-1298, 1316-1317, 1326-1327, 1432-1432, 1445-1445, 1463-1464, 1473-1474, 1586-1586, 1614-1614, 1693-1693, 1774-1774

src/tool/mod.rs (1)

6-21: LGTM!

Also applies to: 33-34, 70-70, 83-86

src/cmd/list.rs (1)

1-1: LGTM!

Also applies to: 41-41, 71-71, 112-112, 139-139, 155-156, 206-206, 539-539, 701-701, 747-747, 814-814

src/cmd/why.rs (1)

1-1: LGTM!

Also applies to: 34-34, 472-472, 516-516, 589-589, 688-688, 739-739, 791-791

src/schema/project.rs (1)

44-44: LGTM!

Also applies to: 58-68, 141-141, 169-169, 181-181, 222-222, 296-296, 363-363, 379-379, 475-475, 486-486, 524-524, 552-552, 564-564, 634-640

tests/docker/README.md (1)

14-16: LGTM!

Also applies to: 34-36

src/detect.rs (2)

97-104: LGTM!

---

1022-1058: LGTM!

src/types.rs (2)

409-410: LGTM!

---

458-469: LGTM!

src/tool/deno.rs (2)

269-273: LGTM!

---

392-404: LGTM!

tests/install_collision.rs (3)

1-1: LGTM!

---

69-73: LGTM!

---

108-120: LGTM!

src/tool/node.rs (2)

392-400: LGTM!

---

1078-1080: LGTM!

tests/nested_warnings.rs (1)

47-57: LGTM!

src/cmd/install.rs (1)

310-334: LGTM!

Also applies to: 444-491, 884-907, 971-993

src/cmd/doctor.rs (1)

338-349: LGTM!

Also applies to: 401-407

src/schema/mod.rs (1)

6-14: LGTM!

Also applies to: 26-41, 64-82

schemas/list.schema.json (1)

77-83: LGTM!

schemas/why.example.json (1)

2-2: LGTM!

schemas/why.schema.json (1)

308-314: LGTM!

src/schema/doctor.rs (1)

171-171: LGTM!

Also applies to: 394-437, 487-543, 1110-1148, 1157-1174, 1249-1249, 1282-1282, 1471-1514

schemas/doctor.schema.json (1)

5-19: LGTM!

Also applies to: 46-128, 342-355, 407-427, 451-492, 580-635, 744-744, 822-852, 1016-1016

src/cli.rs (1)

1262-1270: LGTM!

schemas/doctor.example.json (1)

3-3: LGTM!

Also applies to: 28-30

schemas/list.example.json (1)

2-2: LGTM!

src/cmd/schema.rs (1)

765-803: LGTM!

---

📝 Walkthrough

Resolve install-directory collisions during installation

• Add install planning with configurable resolve/error collision policies.
• Serialise package managers sharing directories while keeping independent installs concurrent.
• Update doctor and warnings to report effective plans, shadowed writers, and deduplicated diagnostics.
• Improve Deno, lockfile, prerelease, and Git-based package-manager detection.
• Version JSON schemas to 2 and extend collision metadata.
• Pin publishing to npm 11 and nightly Rust toolchain.
• Update documentation, generated schemas, and punctuation throughout.

Tests, clippy, formatting, and schema-drift checks pass.

Walkthrough

The change introduces collision-aware install planning through [install].on_collision and RUNNER_INSTALL_ON_COLLISION. Detection records shared install directories, planning selects or rejects writers, and execution serialises conflicting package managers while preserving independent lanes. Doctor reports and JSON schemas now expose install outcomes, schema versions move to 2, nested warnings are deduplicated by project root, and related Deno, lockfile, prerelease, documentation, and release-tooling updates are included.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Detection
  participant Resolver
  participant InstallPlan
  participant PackageManagers
  Detection->>InstallPlan: record install-directory writers
  Resolver->>InstallPlan: resolve collision policy
  InstallPlan->>PackageManagers: create serialised lanes
  PackageManagers-->>InstallPlan: return installation results

Loading

Possibly related PRs

• kjanat/runner#22 — Extends resolver and diagnostics plumbing with install collision handling.
• kjanat/runner#62 — Overlaps on node_modules collision detection and install coordination.
• kjanat/runner#82 — Shares doctor implementation and schema reporting paths.

Poem

Collision winds blow, lanes fall in line,
Bun and Deno wait their turn just fine.
Warnings sail home, once per root,
Schemas chart the install route.
Nightly tools and lockfiles gleam,
A tidier runner joins the dream.

🚥 Pre-merge checks | ✅ 7 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Semver Version Bump Validation	⚠️ Warning	Source files changed, but Cargo.toml stayed 0.19.1 at merge-base and HEAD, so no SemVer bump was made.	Bump the repo version in Cargo.toml to a SemVer matching the change level (at least MINOR; MAJOR if you treat the API/config removals as breaking).

✅ Passed checks (7 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise, conventional, and matches the core change: resolving install-dir collisions.
Description check	✅ Passed	The description is clearly about install-dir collisions and the new install-time resolution flow.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 30.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Changelog Update	✅ Passed	Source files were modified, and CHANGELOG.md has an Unreleased section with Added/Changed/Fixed entries covering the install-collision work.
Agents.Md Documentation Updated	✅ Passed	No AGENTS.md files exist anywhere in the repo, so there was nothing to update despite the workflow/CLI/automation changes.

---

_{Comment @coderabbitai help to get the list of available commands.}