fix: keep the git subdirectory when resolving a committish

[superdejooo]

What / Why

addGitSha rebuilds a git spec from the repository url plus the resolved sha. It builds that url with noCommittish: true and then appends only #<sha>, so the ::path:<dir> selector that npm-package-arg parsed out of the committish is dropped.

Resolving a named ref rewrites

<repo>#main::path:packages/plugin

into

<repo>#<sha>

The resolved spec is what gets recorded and reinstalled from later, so it ends up pointing at the repository root instead of the selected subdirectory. Installing it either fails with Could not read package.json when the root has no manifest, or silently installs the wrong package when it does.

Specs pinned to a full sha are unaffected, because GitFetcher sets resolved from rawSpec and never calls addGitSha. That is why the selector only breaks for branches, tags and semver ranges.

Reproduction against main:

const npa = require('npm-package-arg')
const addGitSha = require('./lib/util/add-git-sha.js')

const spec = npa('github:acme/plugins#main::path:packages/plugin')
console.log(addGitSha(spec, 'a'.repeat(40)))
// github:acme/plugins#aaaa...aaa      <- ::path:packages/plugin is gone

Fix

Re-attach the selector to the resolved spec in both branches. npm-package-arg stores gitSubdir with a leading slash, which the spec syntax does not use, so it is stripped before re-serializing.

The hosted branch round trips too: hosted-git-info treats <sha>::path:<dir> as the committish and preserves it through shortcut() / https() / sshurl(), so #setResolvedWithSha's npa(withSha).hosted → repoUrl(...) step keeps the selector.

Tests

test/util/add-git-sha.js covers the unknown-host, shorthand, https-with-auth, https-without-auth and ssh forms, plus a semver range paired with a subdirectory and a nested subdirectory path. It also asserts the result round trips back through npa with its gitSubdir intact, and that specs without a subdirectory are unchanged.

test/git.js adds an end-to-end case against the local git daemon: a repository whose root manifest is root-package and whose packages/subpkg manifest is sub-package, fetched by branch name. It asserts the resolved spec keeps the selector and that fetching that resolved spec still returns sub-package rather than the root manifest — the behaviour that actually breaks today. The hosted url path is asserted as well.

All new assertions fail on main and pass with the fix. npm run lint passes.

[Copilot]

🟢 Approval recommended

The functional change is well-scoped and backed by targeted unit + E2E tests; remaining feedback is minor naming/comment clarity.

Pull request overview

This PR fixes git dependency resolution so that repository subdirectory selectors (::path:<dir>) are preserved when a named ref (branch/tag/semver range) is resolved to a SHA, preventing later reinstalls from incorrectly targeting the repository root.

Changes:

• Update addGitSha to re-attach ::path:<dir> when rebuilding a resolved git spec.
• Add unit tests ensuring subdirectory selectors survive committish → SHA rewriting and round-trip through npm-package-arg.
• Add an end-to-end GitFetcher test verifying resolved specs keep gitSubdir and still fetch the intended subpackage.

File summaries

File	Description
lib/util/add-git-sha.js	Preserve gitSubdir by appending ::path:<dir> when rewriting specs to a resolved SHA.
test/util/add-git-sha.js	Add coverage for subdirectory selectors across multiple URL/spec forms and round-trip parsing.
test/git.js	Add E2E regression test to ensure GitFetcher.resolve() retains gitSubdir and manifests come from the subdirectory.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[superdejooo]

127.0.0.1 is hosted here: the fixture registers it as localhosthttps with git: among its protocols, while localhost is not.

Existing line 625 already relies on that — it expects git+${remoteHosted}#${REPO_HEAD} for the same URL shape, and that git+ prefix is only added by repoUrl() in the hosted branch.