fix: scan git-root directory before halting lockfile walk in detectWorkspaceInfo (#558)

* Initial plan

* fix: scan .git-containing directory before breaking in detectWorkspaceInfo

Agent-Logs-Url: https://github.com/dmno-dev/varlock/sessions/7f67de8f-0606-4313-9833-b3a8b00f06ba

Co-authored-by: philmillman <3722211+philmillman@users.noreply.github.com>

* fix: make .git boundary test resilient to npm_config_user_agent being set in CI

Agent-Logs-Url: https://github.com/dmno-dev/varlock/sessions/2526c91a-61c4-4880-916b-1cd300a5c93b

Co-authored-by: philmillman <3722211+philmillman@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: philmillman <3722211+philmillman@users.noreply.github.com>

Author: Copilot

.changeset/fix-git-boundary-lockfile-detection.md

@@ -0,0 +1,7 @@
+---
+"varlock": patch
+---
+
+Fix plugin resolution failure in monorepo workspaces where `.git` and the lockfile coexist in the same directory.
+
+`detectWorkspaceInfo()` was checking for a `.git` directory **after** moving to the parent, so in the standard monorepo layout (`monorepo-root/.git` + `monorepo-root/bun.lock`) the root was never scanned and the lockfile was never found. Moving the `.git` boundary check to **before** moving up ensures the git-root directory is always scanned first.

packages/varlock/src/cli/helpers/test/js-package-manager-utils.test.ts

@@ -121,4 +121,32 @@ describe('detectWorkspaceInfo', () => {
     expect(result?.packageManager.name).toBe('bun');
     expect(result?.rootPath).toBe(tempDir);
   });
+
+  test('finds lockfile when .git and lockfile are in the same directory (standard monorepo layout)', () => {
+    // Simulates: monorepo-root/.git + monorepo-root/bun.lock, CWD = monorepo-root/packages/my-app
+    const subDir = path.join(tempDir, 'packages', 'my-app');
+    fs.mkdirSync(subDir, { recursive: true });
+    fs.mkdirSync(path.join(tempDir, '.git'), { recursive: true });
+    fs.writeFileSync(path.join(tempDir, 'bun.lock'), '');
+
+    const result = detectWorkspaceInfo({ cwd: subDir });
+    expect(result?.packageManager.name).toBe('bun');
+    expect(result?.rootPath).toBe(tempDir);
+  });
+
+  test('stops at .git boundary and does not traverse above it to find lockfiles', () => {
+    // Structure: grandparent/bun.lock + parent/.git + parent/src/ (CWD)
+    // The .git boundary should prevent finding bun.lock in grandparent
+    const grandparentDir = tempDir;
+    const parentDir = path.join(tempDir, 'parent');
+    const subDir = path.join(parentDir, 'src');
+    fs.mkdirSync(subDir, { recursive: true });
+    fs.mkdirSync(path.join(parentDir, '.git'), { recursive: true });
+    fs.writeFileSync(path.join(grandparentDir, 'bun.lock'), '');
+
+    const result = detectWorkspaceInfo({ cwd: subDir });
+    // The boundary should prevent finding bun.lock in grandparentDir.
+    // rootPath should never be grandparentDir regardless of npm_config_user_agent fallback.
+    expect(result?.rootPath).not.toBe(grandparentDir);
+  });
 });

packages/varlock/src/lib/workspace-utils.ts

@@ -112,13 +112,15 @@ export function detectWorkspaceInfo(opts?: {
     }
     if (multipleLockfilesDetected) break;
 
+    // stop at git root as a fallback boundary after scanning the current directory
+    // NOTE: check before moving to parent so the directory containing .git is always scanned
+    // (the standard monorepo layout has .git and the lockfile in the same root directory)
+    if (pathExistsSync(path.join(cwd, '.git'))) break;
+
     // will break when we reach the filesystem root
     const parentDir = path.dirname(cwd);
     if (parentDir === cwd) break;
     cwd = parentDir;
-
-    // stop at git root as a fallback boundary when no lockfile has been found yet
-    if (pathExistsSync(path.join(cwd, '.git'))) break;
   } while (cwd);
 
   // if we did not find a lockfile, check env vars for hints (rootPath will be cwd in this case)